Avideo CVE-2026-34740

CVSS 6.5 with network attack vector and low complexity indicates moderate practical exploitability. The vector specifies PR:L (low privilege required), confirming this requires authenticated access but not administrative rights. EPSS data is not provided in the input, limiting probabilistic exploitation assessment. The KEV (CISA Known Exploited Vulnerabilities) status is not indicated, and no public exploit code is known at publication time, suggesting this is a newly disclosed vulnerability with limited real-world weaponization signals. However, the stored nature of the SSRF and the automatic server-side fetching on each EPG page visit amplify real-world impact: the attack persists without re-authentication, and the trigger (page visits) is frequent and inevitable. The lack of a dedicated patch release at time of publication increases urgency, as defenders cannot rely on vendor remediation. The vulnerability's reliance on upload permissions (not admin access) increases the threat model in environments with multiple user accounts or third-party integrations. Overall, this is a genuine high-priority issue despite the moderate CVSS score, driven by the stored exploitation vector, lack of patch, and broad network reconnaissance capabilities.

A malicious authenticated user with upload permissions (or an account with such permissions compromised via phishing or credential stuffing) injects a URL such as 'http://169.254.169.254/latest/meta-data/' (AWS EC2 metadata service) or 'http://internal-admin-panel:8080/api/users' into the EPG link field. On the next EPG page visit by any user, the AVideo server automatically fetches this URL. If the server has network access to internal services or cloud metadata, the attacker receives sensitive information (AWS credentials, internal API responses, service banners) without needing direct network access or elevated privileges. The stored nature means the attack triggers repeatedly without further attacker action, making it a persistent reconnaissance vector.