CVE-2025-34436 | THREATINT

Description

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-17 | Updated 2025-12-19 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status

unaffected

Any version before 20.1

affected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/WWBN/AVideo/commit/4a53ab2056 release-notes

github.com/WWBN/AVideo/commit/c279999cbd patch

www.vulncheck.com/...ories/avideo-idor-arbitrary-file-upload third-party-advisory

chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description exploit

cve.org (CVE-2025-34436)

nvd.nist.gov (CVE-2025-34436)

Download JSON