CVE-2025-34442 | THREATINT

Description

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-17 | Updated 2025-12-19 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Product status

Default status

unaffected

Any version before 20.1

affected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/WWBN/AVideo/commit/4a53ab2056 release-notes

github.com/WWBN/AVideo/commit/dbe3e91c54 patch

www.vulncheck.com/...o-system-path-disclosure-via-public-api third-party-advisory

chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description exploit

cve.org (CVE-2025-34442)

nvd.nist.gov (CVE-2025-34442)

Download JSON