High severity7.5OSV Advisory· Published Dec 17, 2025· Updated Jun 17, 2026

CVE-2025-34442

Description

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WWBN/AvideoOSV2 versions
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*range: <20.0
AVideo/AVideollm-fuzzy
Range: <20.1

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/commit/4a53ab2056nvdPatch
github.com/WWBN/AVideo/commit/dbe3e91c54nvdPatch
www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-apinvdThird Party Advisory
chocapikk.com/posts/2025/avideo-security-vulnerabilities/nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000