CVE-2025-34435

AVideo < 20.1 IDOR Arbitrary File Deletion

HIGH 8.7EPSS 0.3%

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.

Affected: World Wide Broadcast Network · AVideo
CVSS v4.0 VULNCHECK: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 NVD: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.33% chance of exploitation in the next 30 days, 24th percentile
Published: 2025-12-17
Updated: 2026-06-23

Proof-of-concept exploits (1)

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

Security advisories

https://www.vulncheck.com/advisories/avideo-idor-arbitrary-file-deletion
WWBN/AVideo/commit/275a54268b

References

CVE Record
NVD entry