CVE-2026-85161
Received Received - Intake

Cross-Site Request Forgery in AVideo Removes Poster Files

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85161
EUVD
EUVD-2026-70396

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
avideo avideo *
wwbn avideo to c91b5975d (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in AVideo's removePoster.php file. It lacks critical security checks like forbidIfNotPost or forbidIfInvalidToken, allowing attackers to craft malicious image tags that delete authenticated users' live poster and thumbnail files via GET requests.

Detection Guidance

Check AVideo installations for the vulnerable removePoster.php file in plugin/Live/. Monitor server logs for unusual GET requests to removePoster.php with live_servers_id parameters. Look for image tags or requests originating from untrusted sources.

Impact Analysis

An attacker could trick you into visiting a malicious page, causing deletion of your live poster and thumbnail files. This requires you to be logged in and visit the attacker's page. The impact is limited to these specific file types.

Mitigation Strategies

Apply the latest AVideo updates or patches. Add CSRF protections like forbidIfNotPost or forbidIfInvalidToken to removePoster.php. Restrict direct access to removePoster.php via server rules. Monitor for unauthorized file deletions in poster and thumbnail directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart