CVE-2026-85161: AVideo removePoster.php Cross-Site Request Forgery File Deletion
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideo (removePoster.php)to a version that resolves this vulnerability.Patch c91b5975d
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated AVideo users who can access the affected removePoster.php functionality are exposed if they visit an attacker-controlled page. The attacker does not need to authenticate.
What does an attacker need to do to exploit it?
The attacker needs to induce an authenticated victim to load malicious image tags. The vulnerable endpoint accepts GET requests and does not enforce a POST-only request or validate a CSRF token.
What is the impact of successful exploitation?
Successful exploitation can delete the victim's live poster and thumbnail files. The provided impact assessment indicates integrity impact only, with no confidentiality or availability impact.
How can I determine whether my deployment is affected?
The issue affects AVideo through commit c91b5975d. Review whether your deployed code's removePoster.php lacks forbidIfNotPost and forbidIfInvalidToken checks, and whether it permits the relevant deletion action through GET requests.