CVE-2026-33294Server-Side Request Forgery in Avideo

Severity
4.3MEDIUMNVD
EPSS
0.0%
top 91.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
Latest updateMar 19
PublishedMar 22

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved v

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

NVDwwbn/avideo< 26.0
Packagistwwbn/avideo25.0

Patches

🔴Vulnerability Details

2
OSV
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources2026-03-19
GHSA
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources2026-03-19

🕵️Threat Intelligence

1
Wiz
CVE-2026-33294 Impact, Exploitability, and Mitigation Steps | Wiz