CVE-2026-126804

Name of the Vulnerable Software and Affected Versions AVideo versions 12.4 through 29.7.1

Description A path traversal issue exists in the ADs plugin within the 'deleteImage.json.php' endpoint. Authenticated users with custom ads can delete arbitrary files by manipulating the unvalidated is regular user parameter. By providing another user's ID or using ../ sequences, an attacker can delete other users' advertisements or critical system files such as videos/configuration.php, which can result in site downtime and the re-exposure of the installer.

Recommendations Update AVideo to a version later than 29.7.1. Restrict access to the is regular user parameter in the 'deleteImage.json.php' endpoint to prevent unauthorized file deletion.