CVE-2025-34437 — AVideo < 20.1 IDOR Arbitrary Comment Image Upload
AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership ch…
Published: 2025-12-17 · CVSS: 8.7 · CVSS 4.0
AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7