CVE-2025-34436 describes an authorization bypass vulnerability in World Wide Broadcast Network's AVideo product. In versions before 20.1, the upload feature permits authenticated users to place files into directories owned by other users due to insecure direct object reference and lack of ownership checks. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality, integrity, and availability with high severity. No official patch or fix information is provided in the available data.

An attacker with valid authentication can upload files into other users' directories, potentially leading to unauthorized data modification, data leakage, or disruption of service. This compromises the integrity and confidentiality of user data within the application. The vulnerability does not require elevated privileges beyond authentication and can be exploited remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions and monitor user activities closely to detect unauthorized file uploads. Implement additional access controls or custom ownership checks if possible to mitigate risk.