p PatchFirst

CVE-2026-33766

CVE-2026-33766 · AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch.

CVSS 5.3 · Medium · EPSS 0.2%

Published
Updated

Stack: php

Affected products and versions

  • avideo

    Versions
    • <= 26.0: Affected

    No fix published

  • wwbn/avideo Packagist

    Versions
    • 10.4
    • 10.8
    • 11
    • 11.1
    • 11.1.1
    • 11.5
    • 11.6
    • 12.4
    • 14.3
    • 14.3.1
    • 14.4
    • 18.0
    • 21.0
    • 22.0
    • 24.0
    • 25.0
    • 26.0
    Affected ranges
    • ECOSYSTEM: ≤ 26.0

    No fix published

Original sources

Check your server →