CVE-2025-34434

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-34434

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34434.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-34434

Published

2025-12-17T19:49:56.335Z

Modified

2026-07-15T01:48:57.785088743Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion

Details

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

Database specific

{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34434.json",
    "cwe_ids": [
        "CWE-306"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Fixed

4a53ab2056

Fixed

c279999cbd

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34434.json"