What’s Vulnerable › Vulnerabilities

CVE-2026-85160: AVideo through c91b5975d CSRF and Path Traversal via stopLive.php

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-09-08
• Weakness: CWE-73

Description

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7
• https://www.vulncheck.com/advisories/avideo-through-c91b5975d-csrf-and-path-traversal-via-stoplive-php
• https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7

Get alerted when CVE-2026-85160 or the next vulnerability affects your stack