CVE-2025-34434 is a critical flaw (CVSS 9.1) in WWBN AVideo. Versions before 20.1 with the ImageGallery plugin enabled let unauthenticated users upload or delete images tied to any image-based video. The fix shipped in AVideo 20.1, so upgrade, or disable the plugin until you can.
What's affected
The record says AVideo versions prior to 20.1 are affected when the ImageGallery plugin is enabled. If the plugin is off, this specific flaw does not apply to your install, though you should still upgrade.
The fix is in AVideo 20, described in the project's commit as a security hardening release that resolves a batch of reported issues. The commit summary mentions added login checks, per-video authorization checks, and removal of eval based execution paths. The record names version 20.1 as the first unaffected version, so aim for 20.1 or newer and check the project's release notes for the current build.
How to check if you're exposed
Sign in to the AVideo admin area and open the plugin list. Look for ImageGallery and see whether it is enabled. Then read the installed version from the admin footer or the version file in your install.
If you deploy from Git, compare your checkout with the fixed commits linked in the sources below. If you run a container image, check which tag it was built from.
Also check your media store. This flaw allows unauthorized changes to gallery images, so look for images you did not upload, or image videos that lost their pictures. Web server access logs for the plugin's endpoints can show requests that had no session.
What to do now
- Find every AVideo instance and note its version and whether ImageGallery is enabled.
- Upgrade to 20.1 or later.
- If you cannot upgrade yet, disable the ImageGallery plugin.
- Review uploaded images and recent deletions for anything unexpected, and restore from backup where needed.
- Because the same release fixes other reported issues, read the project's notes and update promptly rather than only for this CVE.
Why it matters
The class is missing authentication for a critical function (CWE-306). The plugin's endpoints for managing gallery images did not check who was calling, and did not check whether the caller owned the video. Two separate checks were absent: identity and ownership.
An upload that needs no login can also be a content risk. Even when the stored files are images, the ability to replace or remove media on any video harms a platform's integrity, and it can be used for defacement. The record does not say this CVE is exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
The pattern is common in plugin systems. A core feature checks sessions, and an add-on written later forgets to. When you review plugins, ask of each endpoint who may call it and whose data it touches.
Quick check
Am I affected if ImageGallery is disabled?
The record limits the issue to installs with the ImageGallery plugin enabled. Upgrade anyway, because the 20.x release fixes other reported problems.
What is the safest short term step?
Disable the ImageGallery plugin until you can upgrade to 20.1 or later.
Sources
Last reviewed: 18 October 2026.
