---
id: CVE-2026-85160
title: >-
  AVideo through commit c91b5975d contains a cross-site request forgery and path
  traversal vulnerability in stopLive.php that allows attackers to delete
  directories by exploiting missing token validation and unsanitized key
  parameter conca…
summary: >-
  AVideo through commit c91b5975d contains a cross-site request forgery and path
  traversal vulnerability in stopLive.php that allows attackers to delete
  directories by exploiting missing token validation and unsanitized key
  parameter conca…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
cwe:
  - CWE-73
published: '2026-09-03'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85160'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/avideo-through-c91b5975d-csrf-and-path-traversal-via-stoplive-php
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-qqhx-ccvr-97q7'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00388
epssPercentile: 0.3003
ingestedAt: '2026-09-08T21:11:12.290Z'
---

## Overview

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.