PT-2025-51889 · Avideo · Avideo

Valentin Lobstein · CVE-2025-34437 · Published 2025-12-17 · Updated 2025-12-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1

Description AVideo versions prior to 20.1 allow any authenticated user to upload comment images to videos owned by other users. The ''/comment images'' endpoint validates authentication but does not verify ownership, enabling unauthorized uploads to arbitrary video objects. The vulnerable parameter is video id.

Recommendations Update AVideo to version 20.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-34437

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34437.json · Exploit
• 🔥 https://chocapikk.com/posts/2025/avideo-security-vulnerabilities · Exploit
• https://github.com/WWBN/AVideo/commit/4a53ab2056 · Patch
• https://github.com/WWBN/AVideo/commit/d411f91805 · Patch
• https://osv.dev/vulnerability/CVE-2025-34437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34437 · Security Note
• https://twitter.com/CVEnew/status/2002835969809006717 · Twitter Post
• https://vulncheck.com/advisories/avideo-idor-arbitrary-comment-image-upload · Note
• https://t.me/CVEtracker/40080 · Telegram Post