Unauthenticated File Upload and Deletion in AVideo ImageGallery Plugin by WWBN
CVE-2025-34434

9.3CRITICAL

Key Information:

Vendor

World Wide Broadcast Network

Status
Avideo
Vendor
CVE Published:
17 December 2025

Badges

👾 Exploit Exists

What is CVE-2025-34434?

AVideo versions older than 20.0 with the ImageGallery plugin enabled have a vulnerability allowing unauthenticated users to upload or delete files arbitrarily. The endpoints managing gallery images lack proper authentication enforcement and do not verify ownership. This oversight permits unauthorized attackers to manipulate image assets associated with any video content, posing significant security threats and potential data breaches.

Affected Version(s)

AVideo 0 < 20.1

References

https://github.com/WWBN/AVideo/commit/4a53ab2056
release-notes
https://github.com/WWBN/AVideo/commit/c279999cbd
patch
https://www.vulncheck.com/advisories/avideo-imagegallery-...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
JSON
.