What is the CVSS score of CVE-2026-39370?

CVE-2026-39370 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39370?

WWBN AVideo versions 26.0 and earlier contain a Server-Side Request Forgery vulnerability that allows authenticated users with upload privileges to access internal network resources and exfiltrate…

How to fix or mitigate CVE-2026-39370?

Within 24 hours: Identify all WWBN AVideo 26.0 and earlier installations in your environment and document current user roles with upload permissions. Within 7 days: Implement network-level controls restricting outbound connections from AVideo servers to internal network ranges (RFC 1918, link-local addresses), and disable upload functionality for non-essential user accounts pending patch availability. Within 30 days: Monitor vendor advisories for patch release to AVideo version 26.1 or later; apply immediately upon availability. If patching cannot occur within 60 days, begin migration planning to patched AVideo versions or alternative media hosting platforms.

PHP CVE-2026-39370

EUVD-2026-19886 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-07 GitHub_M

GHSA-cmcr-q4jf-p6q9

SSRF PHP

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 18:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19886

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:26 nvd

HIGH 7.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then fetches the response and stores it as media content. This allows an authenticated uploader to turn the upload-by-URL flow into a reliable SSRF response-exfiltration primitive. The vulnerability is caused by an incomplete fix for CVE-2026-27732.

AnalysisAI

Server-Side Request Forgery (SSRF) in WWBN AVideo 26.0 and earlier allows authenticated uploaders to exfiltrate data from internal network resources via objects/aVideoEncoder.json.php. The flaw bypasses existing SSRF protections by permitting attacker-controlled URLs with common media extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm), forcing the server to fetch and store arbitrary remote content. This represents an incomplete fix for CVE-2026-27732. No public exploit identified at time of analysis. CVSS 7.1 with network-accessible attack vector requiring low-privileged authentication.

Technical ContextAI

The vulnerability resides in WWBN AVideo's aVideoEncoder.json.php endpoint, which implements an upload-by-URL feature for ingesting media content. The flaw stems from insufficient input validation on the downloadURL parameter - specifically, extension-based allowlisting logic that permits common media and archive file types without adequately verifying the URL destination. When an authenticated user with upload privileges submits a crafted URL ending in an approved extension, the server initiates an HTTP request to the attacker-specified target and persists the response as media content. This violates the fundamental SSRF mitigation principle of never trusting user-controlled URLs for server-side fetch operations. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and affects the PHP-based AVideo platform (CPE: cpe:2.3:a:wwbn:avideo). The issue represents a bypass of prior CVE-2026-27732 remediation, indicating the original fix employed extension-based filtering rather than robust URL validation schemes like destination allowlisting or metadata-based content verification.

RemediationAI

Upgrade to the patched AVideo version referenced in the vendor security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-cmcr-q4jf-p6q9. Upstream fix available (PR/commit); released patched version not independently confirmed from provided data. As interim mitigation, restrict upload-by-URL functionality to trusted users only via role-based access controls, implement network egress filtering to block server-initiated requests to private IP ranges (RFC 1918, RFC 4193, 169.254.0.0/16), and enforce strict URL validation with destination allowlisting rather than extension-based filtering. Deploy Web Application Firewall (WAF) rules to detect and block suspicious downloadURL patterns containing internal IP addresses or cloud metadata endpoints. Review server network segmentation to ensure the AVideo application cannot reach sensitive internal services or cloud instance metadata APIs.