A vulnerability in the AVideo application (commit c91b5975d) allows an attacker to trigger a cross‑site request forgery and exploit an unsanitized key parameter. By sending an administrative user a crafted image tag that includes a traversal payload, the attacker can invoke stopLive.php, causing the script to delete directories such as the entire videos folder. This results in permanent data loss for the affected installation. The flaw corresponds to a path‑traversal weakness (CWE‑73).

Administrators operating the WWBN AVideo platform may be affected when their installations contain the vulnerable commit c91b5975d. No specific version range is supplied, so any release that includes that commit without an update is at risk.

The vulnerability carries a CVSS score of 7.2, indicating high severity. EPSS is not available, so the current exploitation probability is unclear, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit it remotely through a CSRF vector. The vulnerability requires that an administrative user loads a malicious page containing the traversal‑enabled key value; once the request is processed, the script recursively removes directory contents, potentially crippling the platform.