CVE-2026-85161 — AVideo removePoster.php Cross-Site Request Forgery File Deletion
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can …
Published: 2026-09-03 · CVSS: 5.3 · CVSS 4.0
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7