AVideo CVE-2026-89257

Exploitation requires three concrete conditions to all be true simultaneously: (1) the attacker must hold a valid authenticated session with the canUpload capability - unauthenticated requests cannot exploit this; (2) the AVideo installation must have the usersCanCreateNewCategories site setting explicitly enabled - this is non-default, so default-configuration deployments are not vulnerable; (3) the attacker must supply a valid CSRF nonce, obtainable from any legitimate AVideo page in the same session. Impact is limited to on-disk asset directory deletion (icons/images); category database records and video files are not affected. Exploitation does not yield code execution, credential access, or privilege escalation.

CVSS 4.0 scores this at 5.3 (Medium) with VI:L/VA:L, which reasonably reflects limited impact: category asset directories are destroyed but no data exfiltration or code execution occurs. The attack requires authentication (PR:L) plus the non-default usersCanCreateNewCategories site option being enabled - installations that ship with the default disabled setting are not vulnerable, materially reducing the exploitable population. EPSS data is not provided; given the restricted deployment condition and medium severity, real-world exploitation probability is low. No KEV listing and no public proof-of-concept were identified at time of analysis. The primary real-world impact is targeted content defacement or disruption of category presentation (broken thumbnails/icons), not a path to privilege escalation or remote code execution. The absence of a patch elevates urgency for operators running vulnerable configurations.

An authenticated low-privilege user with the canUpload capability on an AVideo instance where usersCanCreateNewCategories is enabled sends a crafted POST request to /objects/categoryDeleteAssets.json.php with an arbitrary victim-owned category ID and a valid CSRF nonce. The endpoint passes the ID directly to Category::deleteAssets(), which recursively wipes the target category's asset directory, destroying all icons and thumbnails for that category. No public exploit code was identified at time of analysis, but the attack requires only a valid session and knowledge of a target category ID.