VULNERABILITY INTELLIGENCE
CVE-2026-85161
CVSS score4.3 MEDIUM
EPSS probability0.15%
CISA KEVNot currently listed
Published2026-09-03
Last modified2026-09-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
Weakness classification
- disclosure@vulncheck.com: CWE-352