Vulnerability Description
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7
- https://www.vulncheck.com/advisories/avideo-through-c91b5975d-csrf-and-path-trav
- https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7
FAQ
What is CVE-2026-85160?
CVE-2026-85160 is a vulnerability with a CVSS score of 8.1 (HIGH). AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validatio...
How severe is CVE-2026-85160?
CVE-2026-85160 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85160?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.