VULNERABILITY INTELLIGENCE

CVE-2025-34437

CVSS score8.8 HIGH
EPSS probability0.40%
CISA KEVNot currently listed
Published2025-12-17
Last modified2026-09-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.

Weakness classification

  • disclosure@vulncheck.com: CWE-639

Primary references