CVE-2025-34435: AVideo < 20.1 IDOR Arbitrary File Deletion
AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Fixed in 20.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34435?
CVE-2025-34435 is classified as a high severity vulnerability due to its potential to allow authenticated users to delete other users' media files.
How do I fix CVE-2025-34435?
To fix CVE-2025-34435, upgrade AVideo to version 20.0 or later where the vulnerability is addressed.
What type of vulnerability is CVE-2025-34435?
CVE-2025-34435 is an insecure direct object reference (IDOR) that compromises file ownership verification.
Who is affected by CVE-2025-34435?
All authenticated users of AVideo versions prior to 20.0 are affected by CVE-2025-34435.
What impact does CVE-2025-34435 have on user data?
CVE-2025-34435 allows authenticated users to delete files owned by other users, potentially leading to data loss.