Executive brief
AVideo is a popular video streaming and content management platform used to host and manage video content. An attacker can exploit missing security checks in the stopLive.php endpoint to craft a malicious webpage that, when visited by a logged-in administrator, will recursively delete the entire videos directory—destroying all uploaded video content and disrupting service availability. No special administrator credentials are required; the attacker only needs to trick an admin into visiting a webpage containing the exploit.
Technical details
The vulnerability is a combination of cross-site request forgery (CSRF) and path traversal (CWE-352 and CWE-22). The stopLive.php endpoint accepts a key parameter via $_REQUEST without CSRF token validation (no forbidIfInvalidToken() call), CSRF protection bypass (no POST enforcement via forbidIfNotPost()), or input sanitization. The Live::stopLiveFromkey() function concatenates the unsanitized key parameter directly into a filesystem path and calls rrmdir() for recursive deletion. An attacker can craft an image tag with key=../../videos to traverse directories and delete the videos folder. Attack requires admin session cookie (victim must be logged in) and user interaction (admin must visit attacker's webpage), but no privileges or authentication from the attacker. The endpoint is network-reachable and vulnerable through commit c91b5975d. Patched versions have not yet been released.
Affected products
- WWBN AVideo through commit c91b5975d
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory GHSA-qqhx-ccvr-97q7 published
- 2026-09-03: advisory: CVE-2026-85160 published; NVD entry released