{"id":"CVE-2025-34442","state":"PUBLISHED","title":"AVideo < 20.1 System Path Disclosure via Public API","description":"AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.","publishedAt":"2025-12-17T19:48:39.489Z","updatedAt":"2026-06-23T16:13:34.021Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["World Wide Broadcast Network AVideo"],"affected":[{"vendor":"World Wide Broadcast Network","product":"AVideo","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"20.1","versionType":"custom"}]}],"references":["https://github.com/WWBN/AVideo/commit/4a53ab2056","https://github.com/WWBN/AVideo/commit/dbe3e91c54","https://www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api","https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/"],"weaknesses":["CWE-497"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/34xxx/CVE-2025-34442.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34442","state":"PUBLISHED","datePublished":"2025-12-17T19:48:39.489Z","dateUpdated":"2026-06-23T16:13:34.021Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-04-15T19:15:22.602Z"},"containers":{"cna":{"title":"AVideo < 20.1 System Path Disclosure via Public API","descriptions":[{"lang":"en","value":"AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains."}],"affected":[{"vendor":"World Wide Broadcast Network","product":"AVideo","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"20.1","versionType":"custom"}]}],"references":[{"url":"https://github.com/WWBN/AVideo/commit/4a53ab2056","tags":["patch"]},{"url":"https://github.com/WWBN/AVideo/commit/dbe3e91c54","tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api","tags":["third-party-advisory"]},{"url":"https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/","tags":["technical-description","exploit"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-497","description":"CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-06-23T16:13:34.021Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*","versionEndExcluding":"20.1","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Valentin Lobstein (Chocapikk)"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-17T20:25:29.499153Z","id":"CVE-2025-34442","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-17T20:30:40.968Z"}}]}}}