PT-2025-51888 · Avideo · Avideo

Valentin Lobstein · Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-34436

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 AVideo versions prior to 20.0

Description AVideo versions prior to 20.1 have a flaw where authenticated users can upload files into directories owned by other users. This is due to an insecure direct object reference, meaning the upload functionality confirms a user is logged in but doesn’t verify if they should have access to the target directory. The application does not enforce ownership checks during the file upload process.

Recommendations Update AVideo to version 20.1 or later. Update AVideo to version 20.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-34436

Affected Products

Avideo

References · 8

• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/4a53ab2056 · Patch
• https://github.com/WWBN/AVideo/commit/c279999cbd · Patch
• https://osv.dev/vulnerability/CVE-2025-34436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34436 · Security Note
• https://vulncheck.com/advisories/avideo-idor-arbitrary-file-upload · Note
• https://twitter.com/CVEnew/status/2002835971746746387 · Twitter Post
• https://t.me/CVEtracker/40078 · Telegram Post