Server-Side Request Forgery (SSRF) in AVideo - CVE-2026-33766
Published: May 4, 2026
Vulnerability identifier: #VU129521
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-33766
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: World Wide Broadcast Network
Affected software:
AVideo
AVideo
Detailed vulnerability description
The vulnerability allows a remote user to perform server-side request forgery against internal network resources and cloud metadata services.
The vulnerability exists due to improper restriction of outbound requests in image download endpoints when following HTTP redirects after validating a user-supplied URL. A remote user can supply a crafted URL that redirects to an internal target to perform server-side request forgery against internal network resources and cloud metadata services.
Only the file_get_contents and wget fallback paths are affected; the curl path is not affected. Exploitation requires upload and edit permissions.
How to mitigate CVE-2026-33766
Install security update from vendor's website.