CVE-2025-34442: AVideo < 20.1 System Path Disclosure via Public API

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-17 · updated 2026-06-17
Weakness: CWE-497

Description

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

Affected products

WWBN AVideo: before 20.0 — fixed in 20.0

How to fix

Upgrade to a fixed version: WWBN AVideo 20.0. Check the vendor advisory for mitigations.

References

https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
https://github.com/WWBN/AVideo/commit/4a53ab2056
https://github.com/WWBN/AVideo/commit/dbe3e91c54
https://www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api

Get alerted when CVE-2025-34442 or the next vulnerability affects your stack