CVE-2025-34437

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-34437

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34437.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-34437

Published

2025-12-17T19:50:45.499Z

Modified

2026-07-08T06:56:24.003127924Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

AVideo < 20.1 IDOR Arbitrary Comment Image Upload

Details

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34437.json",
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Fixed

4a53ab2056

Fixed

d411f91805

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34437.json"