CVE-2026-85160
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Sep 03, 2026
Vendor
unknown
Description
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.