CVE-2026-85160 is a high severity flaw in the AVideo Live plugin. The stopLive.php script has no CSRF token and does not sanitize its key parameter, so a page an admin visits could trigger deletion of directories. The advisory lists no patched version, so back up media and restrict the endpoint now.
What's affected
- Product: WWBN AVideo, file
plugin/Live/stopLive.php. - Affected: commit c91b5975d and earlier (GitHub advisory GHSA-qqhx-ccvr-97q7 and VulnCheck agree).
- Patched versions: none listed.
- Conditions in the advisory: the victim must be a logged-in admin who visits a hostile page, and the deletion only happens if a call to the RTMP control server succeeds first.
Severity in the record: High, CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). The record and GitHub both say 8.1 (CVSS v3.1). VulnCheck scores it 7.2 under CVSS v4. The record tags the weakness as CWE-73, while the GitHub advisory names CWE-352 (CSRF) and CWE-22 (path traversal).
Weakness class: CWE-73 (External Control of File Name or Path).
How to check if you're exposed
- Confirm your AVideo commit with
git log -1 --format=%hand compare it with c91b5975d. - Check whether the Live plugin is enabled. If it is not, the vulnerable script is not part of your deployment's active features, though you should still confirm the file is not web reachable.
- Review web server logs for GET requests to
plugin/Live/stopLive.phpwith unusual key values that contain path separators. - Confirm that your latest backup of the videos directory is current and restorable, because recursive deletion is the stated impact.
What to do now
- Back up the videos directory and the database, and test a restore.
- Watch the AVideo repository and the advisory for a fix, then upgrade.
- If you do not use the Live plugin, disable it. If you do, block direct access to
stopLive.phpat the proxy for requests that lack a known internal referrer or source address. - Ask administrators to use a separate browser profile for AVideo admin work and to log out when done, which limits what a hostile page can do with their session.
- Set session cookies to SameSite Lax or Strict where your setup allows it.
Why it matters
Two ordinary mistakes combine here. A state changing action accepts a GET request with no token, so any page that loads an image from the right address makes the admin's browser send it. Then a user supplied value is joined into a filesystem path before a recursive delete, so the target can move outside the folder the code meant to clean.
Either fix alone would reduce the harm. A POST only action with a token blocks the cross-site trigger, and resolving the path and checking that it stays inside the intended folder blocks the traversal. Treat any endpoint that deletes files as sensitive, and test it with hostile input. The record does not mark this CVE as exploited in the wild.
Quick check
Does an attacker need an AVideo account?
Not according to the advisory, but they need an admin to visit a hostile page while logged in. The advisory also notes the deletion only runs if the RTMP control request succeeds.
Sources
Last reviewed: 18 October 2026.
