CVE-2025-34442

Katalog CVE

CVSS 7.5 · High EPSS 0,85%

Kerentanan Exposure of Sensitive System Information to an Unauthorized Control Sphere pada wwbn avideo. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

Rincian

Terbit di NVD

17 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/commit/4a53ab2056 patch
• https://github.com/WWBN/AVideo/commit/dbe3e91c54 patch
• https://www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api advisory pihak ketiga
• https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/