PT-2025-51886 · Avideo · Avideo+1

Valentin Lobstein · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-34434

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.0

Description The AVideo software, when used with the ImageGallery plugin enabled, has a security issue. Unauthenticated attackers can upload or delete images associated with any video due to missing authentication checks and lack of ownership validation in the plugin’s image gallery management endpoints. The affected plugin endpoints do not verify if a user is authorized to perform file operations.

Recommendations Update AVideo to version 20.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-34434

Affected Products

Avideo

Image Gallery

References · 9

• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/4a53ab2056 · Patch
• https://github.com/WWBN/AVideo/commit/c279999cbd · Patch
• https://osv.dev/vulnerability/CVE-2025-34434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34434 · Security Note
• https://t.me/CVEtracker/40077 · Telegram Post
• https://vulncheck.com/advisories/avideo-imagegallery-plugin-unauthenticated-file-upload-and-deletion · Note
• https://twitter.com/0dayPublishing/status/2001384523452371061 · Twitter Post
• https://twitter.com/CVEnew/status/2002835972694655226 · Twitter Post