Detections
Analytics

CVE-2025-34436

high

Description

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.

References

https://www.vulncheck.com/advisories/avideo-idor-arbitrary-file-upload

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

https://github.com/WWBN/AVideo/commit/c279999cbd

https://github.com/WWBN/AVideo/commit/4a53ab2056

Details

Source: Mitre, NVD

Published: 2025-12-17

Updated: 2025-12-19

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00099