CVE-2025-34436: AVideo < 20.1 IDOR Arbitrary File Upload
AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Fixed in 20.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34436?
CVE-2025-34436 is considered a medium severity vulnerability due to the potential for unauthorized file uploads.
How do I fix CVE-2025-34436?
To fix CVE-2025-34436, upgrade to AVideo version 20.0 or later where the vulnerability is addressed.
What impact does CVE-2025-34436 have on users?
CVE-2025-34436 allows authenticated users to upload files to other users' directories, potentially compromising sensitive data.
Are all versions of AVideo affected by CVE-2025-34436?
Yes, all versions of AVideo prior to 20.0 are affected by CVE-2025-34436.
Who is at risk due to CVE-2025-34436?
Any user of AVideo versions prior to 20.0 is at risk due to the inadequate ownership verification during file uploads.