MEDIUM 5.3 NVD
CVE-2026-85161
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken check
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-4h63-5723-hq25
- https://www.vulncheck.com/advisories/avideo-removeposter-php-cross-site-request-forgery-fi
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-03 via NVD.
vulnfeed aggregates 7805 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.