Critical · published December 17, 2025
🚨 Unauthenticated file upload? Yes, please! AVideo versions prior to 20.1 let attackers upload or delete images without breaking a sweat — it’s like giving a stranger a spare key without even checking their ID! 🔥 Think of it as a restaurant where anyone can walk in and start rearranging the menu items or even delete the chef's special, all without a reservation. No checks mean chaos in the ImageGallery, and that’s exactly what’s happening here! This vulnerability is absolutely devastating! An attacker could maliciously upload inappropriate or harmful content, or even delete crucial images related to your videos, disrupting your entire gallery. The lack of authentication checks means anyone can wreak havoc without leaving a trace!
Think of it as a restaurant where anyone can walk in and start rearranging the menu items or even delete the chef's special, all without a reservation. No checks mean chaos in the ImageGallery, and that’s exactly what’s happening here! AVideo's ImageGallery plugin prior to version 20.1 allows unauthenticated file uploads and deletions due to missing authentication and ownership validation on the plugin endpoints, enabling malicious actors a free pass to manipulate your content.
This vulnerability is absolutely devastating! An attacker could maliciously upload inappropriate or harmful content, or even delete crucial images related to your videos, disrupting your entire gallery. The lack of authentication checks means anyone can wreak havoc without leaving a trace! To guard against this, patch AVideo to version 20.1 or later immediately. Additionally, ensure proper authentication checks and ownership validation on all plugin endpoints to strengthen your defenses. You've got this! Follow these steps and turn your security up a notch! 🛡️