CVE-2026-39370 — Server-Side Request Forgery in Avideo

CWE-918 — Server-Side Request Forgery3 documents3 sources
Severity
7.1HIGHNVD
GHSA8.6
EPSS
0.0%
top 91.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
PublishedApr 7
Latest updateApr 8

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then fetches the response and stores it as media content. This allows an authenticated uploader to turn the upload-by-URL flow into a reliable SSRF response-exfiltration primitive. The vulnerability is caused by…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NExploitability: 2.8 | Impact: 4.2

Affected Packages1 packages

▶Packagistwwbn/avideo26.0

🔴Vulnerability Details

1
GHSA
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)↗2026-04-08
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-39370 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶