CVE-2026-85160: External Control of File Name or Path in WWBN AVideo

The vulnerability in AVideo (commit c91b5975d) is due to lack of CSRF token validation and improper sanitization of the 'key' parameter in stopLive.php. This enables an attacker to perform a path traversal attack by injecting directory traversal sequences (e.g., ../../videos) that lead to recursive deletion of directories. The attack requires an admin user to visit a crafted page containing the malicious payload, triggering the deletion. The CVSS 4.0 score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed and high impact on integrity and availability.

Successful exploitation results in deletion of directories on the server, specifically the videos directory, causing potential data loss and service disruption. The vulnerability impacts the integrity and availability of the affected system. No known exploits in the wild have been reported. The attack requires an admin user to visit a malicious page, leveraging CSRF and path traversal to delete critical content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict admin users from visiting untrusted web pages and consider implementing manual validation or filtering of the 'key' parameter in stopLive.php. Applying web application firewall rules to detect and block traversal payloads may provide temporary mitigation.