CVE-2026-85161 AVideo removePoster.php Cross-Site Request Forgery File Deletion
Attackers can trick authenticated users into deleting their live poster and thumbnail files via crafted GET requests in AVideo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-85161?
CVE-2026-85161 is a medium-severity vulnerability in WWBN AVideo, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
Weakness: CWE-352
Which versions are affected by CVE-2026-85161?
How do I fix CVE-2026-85161?
No fix has been published for CVE-2026-85161 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85161 being exploited?
There is no known exploitation of CVE-2026-85161 in the wild and no public exploit code.
Sources
Also known as GHSA-4h63-5723-hq25, GHSA-rqjp-jjmp-m6hm.