PT-2025-51887 · Avideo · Avideo

Valentin Lobstein · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-34435

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1

Description AVideo versions prior to 20.1 are susceptible to an insecure direct object reference (IDOR) that permits any authenticated user to delete media files owned by other users. The affected endpoint confirms authentication but does not verify ownership or editing rights for the specified video. The vulnerable endpoint fails to properly validate access controls, allowing unauthorized file deletion.

Recommendations Update AVideo to version 20.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-34435

Affected Products

Avideo

References · 8

• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/4a53ab2056 · Patch
• https://github.com/WWBN/AVideo/commit/275a54268b · Patch
• https://osv.dev/vulnerability/CVE-2025-34435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34435 · Security Note
• https://vulncheck.com/advisories/avideo-idor-arbitrary-file-deletion · Note
• https://twitter.com/CVEnew/status/2002835970782003676 · Twitter Post
• https://t.me/CVEtracker/40079 · Telegram Post