Vulnerability Description
AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wwbn | Avideo | < 20.0 |
Related Weaknesses (CWE)
References
- https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
- https://github.com/WWBN/AVideo/commit/4a53ab2056Patch
- https://github.com/WWBN/AVideo/commit/d411f91805Patch
- https://www.vulncheck.com/advisories/avideo-idor-arbitrary-comment-image-uploadThird Party Advisory
FAQ
What is CVE-2025-34437?
CVE-2025-34437 is a vulnerability with a CVSS score of 8.8 (HIGH). AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attacker...
How severe is CVE-2025-34437?
CVE-2025-34437 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-34437?
Check the references section above for vendor advisories and patch information. Affected products include: Wwbn Avideo.