What is the CVSS score of CVE-2026-33024?

CVE-2026-33024 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33024?

AVideo versions prior to 8.0 contain a critical Server-Side Request Forgery (SSRF) vulnerability in public thumbnail endpoints that allows unauthenticated attackers to access internal network…. A patch is available.

How to fix or mitigate CVE-2026-33024?

Within 24 hours: identify all AVideo instances in production and document current versions. Within 7 days: upgrade all AVideo deployments to version 8.0 or later per vendor advisory; validate upgrade completion across all environments. Within 30 days: conduct internal network scanning from AVideo servers to verify SSRF attack surface has been eliminated and implement network segmentation restricting AVideo outbound access to required endpoints only.

PHP CVE-2026-33024

EUVD-2026-13557 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-20 security-advisories@github.com

SSRF PHP

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13557

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.

AnalysisAI

AVideo, a video-sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 8.0 affecting the public thumbnail endpoints getImage.php and getImageMP4.php. Unauthenticated attackers can exploit insufficient URL validation to force the server to make requests to internal network resources including cloud metadata endpoints (AWS EC2 169.254.169.254), localhost, and private IP ranges. The vulnerability has a CVSS 4.0 score of 9.3 with network attack vector requiring no privileges or user interaction, though there is no evidence of active exploitation or public proof-of-concept at this time.

Technical ContextAI

The vulnerability (CWE-918: Server-Side Request Forgery) exists in AVideo-Encoder's thumbnail generation endpoints that accept a base64-encoded URL via the base64Url GET parameter. The endpoints decode this parameter and pass the resulting URL directly to ffmpeg as an input source for video processing. The flawed validation only uses PHP's FILTER_VALIDATE_URL to check URL syntax and verifies the protocol starts with http(s)://, but fails to implement allowlists or blocklists for internal network ranges. This permits attackers to supply URLs targeting RFC 1918 private addresses (192.168.x.x, 10.x.x.x, 172.16.x.x), loopback addresses (127.0.0.1), link-local addresses (169.254.x.x used for cloud metadata services), or other internal services. While the vulnerability is blind (responses not directly returned), attackers can infer successful requests through timing analysis and server error logs.

RemediationAI

Upgrade AVideo-Encoder to version 8.0 or later, which includes the security fix as documented in commit f9df098534a0e05fd431e771ac9d70f0f36f1c06 available at https://github.com/WWBN/AVideo-Encoder/commit/f9df098534a0e05fd431e771ac9d70f0f36f1c06. Review the vendor security advisory at https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-h9gh-866r-6vgq for complete remediation guidance. Until patching is feasible, implement network-level controls to restrict outbound connections from the AVideo server to only necessary external services, block access to cloud metadata endpoints (169.254.169.254) and internal RFC 1918 ranges at the firewall or application level, and monitor server logs for suspicious ffmpeg invocations with internal IP addresses. Consider placing the thumbnail generation endpoints behind authentication if business requirements permit.