CVE-2026-126804 · Other
NO FIX YET · SEE WHAT TO DO
AVideo's ADs plugin deleteImage.json.php does not validate the is_regular_user parameter or path sequences, so a logged-in user with custom ads can delete other users' ads or arbitrary files. Deleting videos/configuration.php takes the site offline and re-exposes the installer.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running WWBN AVideo versions 12.4 through 29.7.1 with the ADs plugin enabled, where users can create custom ads. Sites on other versions or without the ADs plugin are not described as affected.
Not affected if default-config, no-ads-plugin
Who cares avideo, php, self-hosted
WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.