What is the CVSS score of CVE-2026-34740?

CVE-2026-34740 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34740?

Yes, a patch is available for CVE-2026-34740. Update the affected software to the latest version immediately.

Avideo CVE-2026-34740

EUVD-2026-17660 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-31 GitHub_M

GHSA-x5vx-vrpf-r45f

SSRF Avideo

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17660

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:57 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows authenticated users with upload permissions to store arbitrary URLs that the server fetches on every EPG page visit. The URL is validated only with PHP's FILTER_VALIDATE_URL, which accepts internal network addresses. Although AVideo has a dedicated isSSRFSafeURL() function for preventing SSRF, it is not called in this code path. This results in a stored server-side request forgery vulnerability that can be used to scan internal networks, access cloud metadata services, and interact with internal services. At time of publication, there are no publicly available patches.

AnalysisAI

Stored server-side request forgery (SSRF) in WWBN AVideo 26.0 and prior allows authenticated users with upload permissions to inject arbitrary URLs into the EPG (Electronic Program Guide) link feature, which the server automatically fetches on each EPG page visit. This enables attackers to scan internal networks, access cloud metadata services, and interact with internal services without the authentication or complexity barriers normally present in network-based attacks. No public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability exists in AVideo's EPG link feature, which stores user-supplied URLs in a persistent manner. The root cause (CWE-918: Server-Side Request Forgery) stems from insufficient URL validation: the application uses only PHP's FILTER_VALIDATE_URL function, which has permissive validation logic and accepts internal network addresses (RFC 1918 ranges, localhost, etc.) as syntactically valid. AVideo maintains a dedicated isSSRFSafeURL() function designed to enforce stricter network access controls, but this function is not invoked in the EPG code path. As a result, when the EPG page is visited, the server automatically fetches the attacker-controlled URL without additional security checks, creating a persistent SSRF condition triggered on every page load. The attack surface spans any user account with upload permissions, reducing the barrier to exploitation within multi-user deployments.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation measures are required: (1) restrict upload permissions to trusted users only and audit existing user accounts; (2) implement network segmentation to limit the server's ability to reach internal services, cloud metadata endpoints (such as 169.254.169.254), and sensitive internal hosts; (3) monitor HTTP/HTTPS requests originating from the AVideo server process for suspicious outbound connections to internal IP ranges or metadata services; (4) review EPG link entries in the AVideo database for suspicious URLs and remove them. Monitor the GitHub Security Advisory (GHSA-x5vx-vrpf-r45f) and WWBN AVideo release notes for patch availability. Alternatively, disable the EPG link feature if not operationally critical until a patch is released.