CVE-2026-85161
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Sep 03, 2026
Vendor
unknown
Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.