CVE-2026-85161: Cross-Site Request Forgery (CSRF) in WWBN AVideo

WWBN AVideo contains a CSRF vulnerability in the removePoster.php endpoint due to missing validation checks that would normally prevent unauthorized requests. Specifically, the absence of forbidIfNotPost or forbidIfInvalidToken checks allows attackers to exploit this by sending crafted GET requests, for example via malicious image tags, to delete poster and thumbnail files belonging to authenticated users. This vulnerability was identified in commit c91b5975d. No patch or official remediation guidance is currently provided.

An attacker can cause deletion of live poster and thumbnail files of authenticated users without their consent by tricking them into visiting a malicious page. This can lead to loss of media content associated with user accounts. The vulnerability requires user interaction (UI:P) but does not require privileges or authentication beyond the victim being logged in. There is no indication of further escalation or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about visiting untrusted websites while authenticated to the affected AVideo instance. Implementing CSRF protections such as requiring POST requests and validating anti-CSRF tokens on the removePoster.php endpoint is recommended once a patch is released.