CVE-2026-61575: AVideo Encoder: stored XSS via queue title hits admins

MEDIUM

Published October 28, 2026

CISO Take

AVideo Encoder (before 8.1.0) stores an unsanitized filename from a caller-controlled fileURI as a queue title, and the admin queue grid renders it as raw HTML, so a low-privilege attacker can run script in an administrator's browser. The attacker can self-grant the upload capability through a login site they control, so no legitimate encoder credentials are needed. The script can read session-visible data and rendered streamer credentials and act with the viewer's privileges, and it re-fires for every qualifying viewer until the row is removed. Urgency is limited: CVSS is 4.7 (medium), the product is a general video platform and not core AI/ML tooling, it is not in CISA KEV, there is no public exploit or Nuclei template, and EPSS data is unavailable. Upgrade to 8.1.0, then review the encoder queue for rows with HTML in the title and rotate streamer credentials if an admin may have viewed a malicious entry.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium overall (CVSS 3.1: 4.7). Exploitation is network-reachable and needs no privileges, but it has high attack complexity and requires an administrator, or an operator on the attacker's streamer, to view the queue. Scope is changed because the script runs in the victim's browser context. Confidentiality and integrity impact are low each, and there is no availability impact. Not in KEV, no public exploit, no scanner template. The 'ml_ui' classification is a loose fit, since AVideo is a video-sharing platform and not an ML interface. AI-specific risk is low unless the platform is used to serve or manage AI-generated media workflows.

How does the attack unfold?

Initial Access

Attacker self-grants upload capability via an attacker-controlled login site and submits a queue entry to view/queue.php.

AML.T0049

Payload Storage

The HTML payload from the fileURI filename is stored unsanitized in encoder_queue.title.

Execution

An administrator or streamer operator opens the queue grid and the Bootgrid formatter renders the payload as raw HTML, running the script in their browser.

AML.T0011.003

Impact

Script reads session data and streamer credentials and acts with the viewer's privileges, repeating for each viewer until the row is removed.

AML.T0055

Initial Access

Attacker self-grants upload capability via an attacker-controlled login site and submits a queue entry to view/queue.php.

AML.T0049

Payload Storage

The HTML payload from the fileURI filename is stored unsanitized in encoder_queue.title.

Execution

An administrator or streamer operator opens the queue grid and the Bootgrid formatter renders the payload as raw HTML, running the script in their browser.

AML.T0011.003

Impact

Script reads session data and streamer credentials and acts with the viewer's privileges, repeating for each viewer until the row is removed.

AML.T0055

How severe is it?

CVSS 3.1

4.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade AVideo Encoder to 8.1.0 or later (see the GHSA-w2g8-p296-r5g9 advisory and the linked commit). 2) Until patched, restrict access to the encoder and queue pages to trusted networks and limit who can view the queue. 3) Review the encoder_queue table for titles containing HTML tags or event handlers such as onerror, onload or onmouseover, and delete any suspicious rows. 4) Rotate streamer credentials and sessions if an admin may have viewed a malicious row. 5) Disable or tighten untrusted login-site integrations that allow self-granted upload capability. 6) Deploy a strict Content Security Policy that blocks inline event handlers, and monitor for unexpected outbound requests from admin browsers.

How is it classified?

Data LeakageAuth BypassFrameworkAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party component risk

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-61575?

Is CVE-2026-61575 actively exploited?

No confirmed active exploitation of CVE-2026-61575 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-61575?

1) Upgrade AVideo Encoder to 8.1.0 or later (see the GHSA-w2g8-p296-r5g9 advisory and the linked commit). 2) Until patched, restrict access to the encoder and queue pages to trusted networks and limit who can view the queue. 3) Review the encoder_queue table for titles containing HTML tags or event handlers such as onerror, onload or onmouseover, and delete any suspicious rows. 4) Rotate streamer credentials and sessions if an admin may have viewed a malicious row. 5) Disable or tighten untrusted login-site integrations that allow self-granted upload capability. 6) Deploy a strict Content Security Policy that blocks inline event handlers, and monitor for unexpected outbound requests from admin browsers.

What systems are affected by CVE-2026-61575?

This vulnerability affects the following AI/ML architecture patterns: Media encoding and streaming platforms, Web admin dashboards, AI-generated media publishing pipelines.

What is the CVSS score for CVE-2026-61575?

CVE-2026-61575 has a CVSS v3.1 base score of 4.7 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

Media encoding and streaming platformsWeb admin dashboardsAI-generated media publishing pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. `Encoder::getAll` limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second `.html()` sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.

Exploitation Scenario

An attacker sets up a login site they control and uses it to obtain upload capability on a target AVideo Encoder instance. They submit a queue entry whose fileURI filename contains an HTML payload with an event handler, which is stored in encoder_queue.title. When an administrator opens the encoder dashboard, the Bootgrid title formatter injects the payload into the page and the script runs in the admin's browser. It exfiltrates rendered streamer credentials and session-visible data, or performs privileged actions. It fires again for every admin who views the queue until the row is removed.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.