High severity · published Dec 17, 2025
CVE-2025-34437
AVideo < 20.1 IDOR Arbitrary Comment Image Upload
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
AVideo · World Wide Broadcast Network
before 20.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34437
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34437
chocapikk.com
https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
Patch
https://github.com/WWBN/AVideo/commit/4a53ab2056
Patch
https://github.com/WWBN/AVideo/commit/d411f91805
Third Party Advisory
https://www.vulncheck.com/advisories/avideo-idor-arbitrary-comment-image-upload
More from AVideo
9.3
CVE-2025-34433
AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
9.1
CVE-2025-34434
AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion
8.8
CVE-2025-34436
AVideo < 20.1 IDOR Arbitrary File Upload
8.1
CVE-2025-34438
AVideo < 20.1 IDOR Arbitrary Video Rotation
7.5
CVE-2025-34442
AVideo < 20.1 System Path Disclosure via Public API