CVE-2025-34442 json
AVideo < 20.1 System Path Disclosure via Public API
published 10mo ago modified 4mo ago also EUVD-2025-203948
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 1
- Metasploit
Summary
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.
Patch / fix
- World Wide Broadcast Network AVideo 20.1
- github.com/WWBN/AVideo@4a53ab2 commit
- github.com/WWBN/AVideo@dbe3e91 commit
Is CVE-2025-34442 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- First public exploit (Metasploit exploit/multi/http/avideo_notify_ffmpeg_unauth_rce)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10mo ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/http/avideo_notify_ffmpeg_unauth_rce AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery metasploit exploit, excellent rank, 2025-12-19
- chocapikk.com https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- World Wide Broadcast Network AVideo
Classification
- Weakness
-
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
References
-
github.com
/WWBN/AVideo/commit/4a53ab2056
patch
-
github.com
/WWBN/AVideo/commit/dbe3e91c54
patch
-
chocapikk.com
/posts/2025/avideo-security-vulnerabilities/
technical-description, exploit
-
vulncheck.com
/advisories/avideo-system-path-disclosure-via-public-api
third-party-advisory
Sources
- CVE List CVE-2025-34442
- NVD CVE-2025-34442
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.