Vulnerability · Published Dec 17, 2025 · Assigned by VulnCheck

CVE-2025-34434AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion

Critical 9.3

In plain English

A critical-severity missing authentication in AVideo from World Wide Broadcast Network. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

Affected products (as reported)

Vendor	Product	Versions
World Wide Broadcast Network	AVideo	0 – before 20.1

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/WWBN/AVideo/commit/4a53ab2056 patch
https://github.com/WWBN/AVideo/commit/c279999cbd patch
https://www.vulncheck.com/advisories/avideo-imagegallery-plugin-unauthenticated-file-upload-and-deletion third-party-advisory
https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description, exploit