CVE-2025-34442 is a vulnerability in World Wide Broadcast Network's AVideo product where versions prior to 20.1 leak absolute filesystem paths via several public API endpoints. The metadata returned by these endpoints includes full server paths to media files, exposing the underlying filesystem structure. This information disclosure can facilitate attackers in understanding the server environment, which may assist in further exploitation. The vulnerability is classified under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. The CVSS 4.0 vector indicates network attack vector with low complexity and no privileges or user interaction required, but with low impact on confidentiality, integrity, and availability.

The vulnerability allows unauthorized users to obtain absolute filesystem paths from the server hosting AVideo. While this does not directly compromise system integrity or availability, it reveals sensitive system information that could be leveraged to enhance the effectiveness of subsequent attacks. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the affected API endpoints or implementing compensating controls to limit exposure of sensitive filesystem information.