WWBN AVideo CVE-2026-85160

Exploitation requires that an authenticated AVideo administrator visit an attacker-controlled page while holding an active session cookie to the target AVideo instance - the CSRF mechanism relies on the browser automatically attaching session credentials to the cross-origin request. The stopLive.php endpoint must be reachable from the admin's browser, which is true of any internet-accessible or intranet-accessible AVideo deployment. No special AVideo feature or non-default configuration is required beyond a running AVideo instance with live-streaming functionality present. Exploitation is limited by the need to social-engineer a specific privileged user (admin), and the impact scope is bounded by the filesystem permissions of the AVideo web process - if the web server user lacks write access to directories above the live-streaming root, traversal depth is constrained. No authentication, API key, or knowledge of credentials is required from the attacker's perspective.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) accurately reflects the core threat model: network-accessible exploitation with no attacker privileges required, but contingent on an authenticated admin visiting a malicious page (UI:P). The chained CSRF-plus-traversal design is particularly dangerous because the CSRF component removes the authentication barrier entirely - any attacker who can lure an admin to a controlled webpage can delete critical server directories without knowing credentials. The resulting VI:H/VA:H impact from irreversible recursive deletion of video content could be catastrophic for media-hosting deployments; even a mid-sized municipal IT team in malbork operating a public AVideo instance would face significant data loss with no easy rollback absent offline backups. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, making exploitation frequency unknown; however, the simplicity of the attack (a single crafted img tag) means it is trivially automatable once an admin target is identified. The CVSS 7.2 score modestly understates operational risk for organizations without strong backup disciplines.

An attacker crafts a malicious webpage containing an HTML img tag whose src attribute points to the target AVideo instance's stopLive.php with the payload key=../../videos. When an AVideo administrator visits the malicious page while authenticated, the browser automatically issues the cross-origin GET request carrying the admin's session cookie; stopLive.php processes the request, traverses up from the live-streaming directory, and recursively deletes the videos directory and all stored media. No public proof-of-concept code has been confirmed at time of analysis, but the attack requires only standard HTML and is trivially reproducible from the vulnerability description.