CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...