CVE-2026-33351
CVE-2026-33351 · AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST['webSiteRootURL']` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.
CVSS 9.1 · Crítica · EPSS 0,4%
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
avideo
- Versiones
- < 26.0: Afectada
Sin corrección publicada
wwbn/avideo Packagist
- Versiones
- 10.4
- 10.8
- 11
- 11.1
- 11.1.1
- 11.5
- 11.6
- 12.4
- 14.3
- 14.3.1
- 14.4
- 18.0
- 21.0
- 22.0
- 24.0
- 25.0
- 26.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≤ 26.0
Sin corrección publicada