VULNERABILITY INTELLIGENCE

CVE-2025-34438

CVSS score8.1 HIGH
EPSS probability0.28%
CISA KEVNot currently listed
Published2025-12-17
Last modified2026-09-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

Weakness classification

  • disclosure@vulncheck.com: CWE-639

Primary references