AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.

AVideo through commit c91b5975d is affected by a combined cross-site request forgery (CSRF) and path traversal vulnerability in the stopLive.php script. The vulnerability stems from missing CSRF token validation and unsanitized concatenation of the 'key' parameter, allowing attackers to craft malicious image tags with directory traversal payloads such as key=../../videos. When an authenticated administrator visits a malicious page, the payload triggers recursive deletion of targeted server directories, including the videos directory. Exploitation requires no authentication from the attacker but relies on social engineering an admin into visiting a crafted page. The impact is destructive, as it can result in permanent data loss through directory deletion. A fix has been documented in a GitHub security advisory for the WWBN/AVideo repository.