Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85160AVideo through c91b5975d CSRF and Path Traversal via stopLive.php

High 8.1

In plain English

A high-severity security flaw in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through c91b5975d

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-qqhx-ccvr-97q7) vendor-advisory
VulnCheck Advisory: AVideo through c91b5975d CSRF and Path Traversal via stopLive.php third-party-advisory