PT-2025-51875 · Avideo · Avideo

Valentin Lobstein · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-34442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1

Description AVideo versions prior to 20.1 disclose absolute filesystem paths through multiple public API endpoints. The returned metadata includes full server paths to media files, revealing the underlying filesystem structure and potentially enabling more effective attack chains.

Recommendations Update AVideo to version 20.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-34442

Affected Products

Avideo

References · 8

• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/4a53ab2056 · Patch
• https://github.com/WWBN/AVideo/commit/dbe3e91c54 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34442 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34442 · Vendor Advisory
• https://t.me/CVEtracker/40074 · Telegram Post
• https://vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api · Note
• https://twitter.com/CVEnew/status/2002835975777460664 · Twitter Post