CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, "view/queue.php" uses "pathinfo" on the caller-controlled "fileURI" and stores its filename through "setTitle" in "encoderqueue.title" without neutralization. "fileURI" is not in the "objects/security.php" filter lists, and the "Login::canUpload...