Vulnerability Description
AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wwbn | Avideo | < 20.0 |
Related Weaknesses (CWE)
References
- https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
- https://github.com/WWBN/AVideo/commit/4a53ab2056Patch
- https://github.com/WWBN/AVideo/commit/c279999cbdPatch
- https://www.vulncheck.com/advisories/avideo-idor-arbitrary-file-uploadThird Party Advisory
FAQ
What is CVE-2025-34436?
CVE-2025-34436 is a vulnerability with a CVSS score of 8.8 (HIGH). AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authe...
How severe is CVE-2025-34436?
CVE-2025-34436 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-34436?
Check the references section above for vendor advisories and patch information. Affected products include: Wwbn Avideo.