CVE-2025-34434
CriticalSummary
AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.
Risk Assessment
The risk includes the possibility of unauthorized file upload and deletion, which could lead to content integrity compromise and potentially further attacks.
Recommendation
It is recommended to upgrade AVideo to version 20.1 or later and disable the ImageGallery plugin if not essential until patches are applied.
Original NVD description (English source)
AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.