Description

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-03T13:06:22.967Z",
  "pubdate": "2026-09-03T13:06:22.967Z",
  "executiveSummary": "AVideo, up to commit c91b5975d, is affected by a critical vulnerability involving Cross-Site Request Forgery (CSRF) and path traversal in stopLive.php.\nThis vulnerability allows an unauthenticated remote attacker to trigger the unauthorized recursive deletion of arbitrary directories on the host server.\nThe flaw stems from a lack of anti-CSRF token validation combined with insufficient input sanitization on the 'key' parameter, which is concatenated into file system path operations.\nBy inducing an authenticated administrator to visit a malicious, attacker-controlled page, the attacker can execute arbitrary directory deletion commands with the privileges of the web application.\nThis poses a severe risk to data integrity and system availability, as attackers can cause permanent data loss by traversing the file system and deleting sensitive directory structures, such as the 'videos' repository.\nSuccessful exploitation requires the attacker to successfully perform a CSRF attack against an active administrative session, making this a high-impact vulnerability that mandates immediate remediation.",
  "technicalDetails": "The vulnerability is located in 'stopLive.php', which fails to implement robust request validation mechanisms, specifically missing CSRF protection. This oversight allows an attacker to forge requests that are executed within the context of an authenticated user's session.\nThe primary vector is the 'key' parameter, which is improperly sanitized before being used in server-side file system operations. Because the application fails to validate the integrity of this input, an attacker can supply directory traversal sequences (e.g., '../') to manipulate the intended file system path.\nWhen a request is submitted to 'stopLive.php' with a malicious 'key' parameter, the application concatenates the input to a base directory path. By injecting '..', the application escapes the restricted directory scope, allowing the underlying logic to target unintended portions of the server's file system.\nThe exploitation flow proceeds as follows: First, the attacker crafts a malicious web page containing an HTML element, such as an <img> tag, with the 'src' attribute pointing to the vulnerable 'stopLive.php' endpoint, including a crafted 'key' parameter (e.g., 'key=../../videos').\nSecond, the attacker social-engineers an administrator who currently maintains an active session with the AVideo application into viewing the malicious page. The browser automatically sends a request to the vulnerable endpoint using the administrator's credentials.\nThird, the server processes this request without verifying an anti-CSRF token. The vulnerable code executes a recursive deletion operation, targeting the directory resolved through the malicious traversal path provided in the 'key' parameter.\nThe 'videos' directory, which is essential for the product's primary functionality, is then subject to recursive deletion. Because the application runs with the permissions of the web server user, the deletion is executed with the authority granted to the service, resulting in permanent loss of data.\nThis vulnerability is present in AVideo through commit c91b5975d and represents a classic case of insufficient input validation combined with inadequate state-changing request protection, leading to arbitrary file system impact."
}