A cross‑site request forgery flaw in the removePoster.php script of the AVideo application allows attackers to delete an authenticated user’s poster and thumbnail image files by sending a crafted GET request. The vulnerability arises because the script omits checks for a mandatory POST method and a valid CSRF token. This weakness permits an attacker to remove important media assets from the victim’s account, effectively causing data loss and potentially impacting the availability of content.

The affected system is the AVideo video platform distributed by WWBN. Versions that include the commit c91b5975d or earlier are vulnerable; any installation running this code without the subsequent patch is at risk.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by luring an authenticated user to visit a malicious image tag that triggers a GET request to removePoster.php, thereby deleting the user’s poster and thumbnail files. Successful exploitation requires an active session for the targeted user and relies on social engineering or other cloaked methods to deliver the malicious payload.