CVE-2026-85160
AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 3, 2026
- Updated
- Sep 3, 2026
- Reserved
- Sep 3, 2026
Description
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
AVideoWWBN |
|
References
- GitHub Security Advisory (GHSA-qqhx-ccvr-97q7)vendor-advisory
- VulnCheck Advisory: AVideo through c91b5975d CSRF and Path Traversal via stopLive.phpthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.