CVE-2026-85160: AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
AVideo instances are exposed when an administrator can be induced to visit an attacker-controlled malicious page. The attack is delivered through a crafted image request and does not require the attacker to authenticate.
What is the likely impact if exploitation succeeds?
The attacker can trigger recursive deletion of directories through the vulnerable stopLive.php endpoint. The provided example uses a traversal payload to delete the videos directory, affecting integrity and availability.
How can I determine whether my installation is affected?
The affected scope is AVideo through commit c91b5975d. Review whether your deployed code includes stopLive.php with missing token validation and direct concatenation of the key parameter into a filesystem path.