AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. "view/run.php" has a commented-out guard and invokes "Encoder::run()". "view/queue.json.php" calls "Encoder::getAll(true)", reveals streamer URLs through "getSiteURL()", and triggers processing with "execRun()". "view/status.php" returns "Access-Control-Allow-Origin" with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through "ServerMonitor::getMemory()" when "serverStatus" is set. "view/listFiles.json.php" checks only "Login::canBulkEncode()", which admits anonymous callers whenever "disableBulkEncode" is empty, the default. Its "path" parameter is resolved with "realpath()" and listed with "scandir()" without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.