CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload() capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. view/index.php loads queue.json from view/queue.json.php into the #grid jQuery Bootgrid table; its title formatter concatenates row.title into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. Encoder::getAll limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second .html() sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.