Cross-Site Request Forgery in AVideo Affecting File Management
CVE-2026-85161

5.3MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85161?

AVideo has a vulnerability in the removePoster.php file stemming from a lack of proper validation checks. This allows malicious actors to create crafted image tags that can execute unauthorized deletion of poster and thumbnail images from the accounts of authenticated users via GET requests. Without sufficient protections in place, this weakness poses a significant risk to the integrity of user-generated content and web application security.

Affected Version(s)

AVideo 0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-4...
vendor-advisory
https://www.vulncheck.com/advisories/avideo-removeposter-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

santhreal
.