CVE-2026-85160

AVideo through commit c91b5975d is vulnerable to a cross-site request forgery combined with a path traversal flaw in stopLive.php, where requests lack token validation and the key parameter is concatenated into a filesystem path without sanitization. An attacker can embed an image tag or similar request pointing at stopLive.php with a traversal payload such as key=../../videos, and when a logged-in administrator visits an attacker-controlled page, the browser silently issues the request and the server recursively deletes the targeted directory. Successful attacks can wipe arbitrary directories within the application's reach, for example the videos directory, destroying hosted content and disrupting the service, with high integrity and availability impact but no confidentiality impact (CVSS 4.0: 7.2 High). Only operators of self-hosted AVideo instances are affected, and exploitation requires an authenticated administrator to interact with attacker-controlled content. No public proof of concept, KEV listing, or in-the-wild exploitation is known, and EPSS assigns a 0.2% probability of exploitation within 30 days.

What to do: Update AVideo past commit c91b5975d once an upstream fix is available, and in the meantime restrict access to stopLive.php or require CSRF token validation on it. Check whether the videos directory or other unexpected paths have been deleted, and avoid administrators browsing untrusted sites while authenticated to the AVideo panel.