CVE-2025-34442

HIGH

AVideo < 20.1 - Sensitive System Information Exposure via Public API Endpoints

Title source: llm

Description

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

References (4)

Core 4

Core References

Patch release-notes

https://github.com/WWBN/AVideo/commit/4a53ab2056

View Patch ZIP pw:eip

Patch patch

https://github.com/WWBN/AVideo/commit/dbe3e91c54

View Patch ZIP pw:eip

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api

Various Sources technical-description exploit

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/

Scores

CVSS v3 7.5

EPSS 0.0073

EPSS Percentile 49.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-497

Status published

Products (2)

World Wide Broadcast Network/AVideo < 20.1

wwbn/avideo < 20.0

Published Dec 17, 2025

Tracked Since Feb 18, 2026