HIGH 7.2 NVD
CVE-2026-85160
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directori
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7
- https://www.vulncheck.com/advisories/avideo-through-c91b5975d-csrf-and-path-traversal-via-
- https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-09-03 via NVD.
vulnfeed aggregates 7805 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.