CVE-2026-85160 in AVideo
Summary
by MITRE • 09/03/2026
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in AVideo, specifically within the stopLive.php component prior to commit c91b5975d, represents a critical combination of cross-site request forgery and path traversal flaws that can lead to severe data loss. This issue stems from two distinct but compounding technical deficiencies: the absence of anti-CSRF token validation on state-changing operations and the failure to properly sanitize user-supplied input before concatenating it into file system paths. When an administrator interacts with a maliciously crafted page, such as one containing a hidden image tag designed to trigger a request to stopLive.php, the application processes this request without verifying its authenticity or origin. This lack of validation allows attackers to force authenticated users to perform actions they did not intend, effectively bypassing access controls that rely solely on session cookies for authentication verification.
The core technical flaw lies in how the key parameter is handled within the script. The application accepts a user-controlled value and directly concatenates it into a directory path without implementing adequate sanitization or validation checks against relative path sequences like dot-dot-slash. By injecting payloads such as ../../videos, an attacker can manipulate the file system navigation logic to escape the intended target directory. This traversal mechanism allows the deletion function to reach sensitive directories outside of its designated scope. The operational impact is particularly devastating because it enables recursive deletion of critical data stores, specifically the videos directory which houses user-generated content and media files. Since this action requires administrative privileges or a privileged session context, the exploitation relies on social engineering tactics to lure an admin into triggering the malicious request, thereby turning a routine interface interaction into a destructive event that can result in permanent loss of platform assets.
From a classification perspective, this vulnerability aligns with CWE-352, which describes cross-site request forgery as a flaw where a user's current session is tricked into performing an unwanted action on behalf of the attacker. Furthermore, the path traversal aspect corresponds to CWE-22, indicating improper limitation of a pathname to a restricted directory. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this exploit leverages techniques associated with T1078, specifically valid accounts and default credentials if combined with weak authentication, but more directly relates to persistence or impact tactics where an attacker uses trusted applications to execute malicious commands that compromise data integrity. The specific action of deleting directories falls under the Impact category, reflecting the adversary's goal of disrupting availability by destroying information resources.
Mitigation strategies must address both the procedural and technical aspects of this vulnerability. First and foremost, implementing robust anti-CSRF tokens for all state-changing operations is essential to ensure that requests originate from legitimate sources within the application context. These tokens should be unique per session and validated server-side before any destructive action is taken. Additionally, strict input validation must be applied to the key parameter used in file path construction. This involves rejecting inputs containing relative path sequences or ensuring they are resolved against a canonical base directory that prevents escape attempts. Developers should also adopt least privilege principles by limiting the permissions of the web application process so it cannot access sensitive directories even if traversal is attempted. Regular security audits and code reviews focusing on file system operations can further reduce the risk of such vulnerabilities persisting in future releases, ensuring that administrative functions remain protected against both forgery attacks and path manipulation exploits.