CVE-2026-33039
CVE-2026-33039 · AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.
CVSS 8.6 · Élevée · EPSS 0,5%
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
avideo
- Versions du logiciel
- < 26.0: Concernée
Aucun correctif publié
wwbn/avideo Packagist
- Versions du logiciel
- 10.4
- 10.8
- 11
- 11.1
- 11.1.1
- 11.5
- 11.6
- 12.4
- 14.3
- 14.3.1
- 14.4
- 18.0
- 21.0
- 22.0
- 24.0
- 25.0
- Plages de versions concernées
- ECOSYSTEM: ≤ 25.0
Aucun correctif publié