SB2026050473 - Server-Side Request Forgery (SSRF) in AVideo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050473

SB2026050473 - Server-Side Request Forgery (SSRF) in AVideo

Published: May 4, 2026

Security Bulletin ID SB2026050473
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-33766)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform server-side request forgery against internal network resources and cloud metadata services.

The vulnerability exists due to improper restriction of outbound requests in image download endpoints when following HTTP redirects after validating a user-supplied URL. A remote user can supply a crafted URL that redirects to an internal target to perform server-side request forgery against internal network resources and cloud metadata services.

Only the file_get_contents and wget fallback paths are affected; the curl path is not affected. Exploitation requires upload and edit permissions.


Remediation

Install update from vendor's website.

References