CVE-2025-34442

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-34442

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34442.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-34442

Published

2025-12-17T19:48:39.489Z

Modified

2026-07-08T06:35:37.222153290Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

AVideo < 20.1 System Path Disclosure via Public API

Details

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34442.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-497"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Fixed

4a53ab2056

Fixed

dbe3e91c54

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34442.json"