Avideo CVE-2026-39370

Requires authenticated uploader account in WWBN AVideo versions 26.0 and prior. Attacker exploits objects/aVideoEncoder.json.php upload-by-URL feature with URLs containing bypassed extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm) to perform SSRF and exfiltrate server responses.

Real-world risk is moderate-to-high for organizations deploying AVideo internally or in multi-tenant environments. The CVSS base score of 7.1 reflects high confidentiality impact (C:H) with network attack vector (AV:N) and low attack complexity (AC:L), though exploitation requires low-privileged authentication (PR:L). EPSS data not provided, but no confirmed active exploitation exists (not present in CISA KEV). The primary risk materializes in environments where AVideo servers have access to internal network segments, cloud metadata services (e.g., AWS EC2 IMDSv1 at 169.254.169.254), or privileged APIs. An authenticated uploader can leverage this as a reliable data exfiltration primitive to probe internal services, retrieve cloud credentials, or access restricted endpoints that trust requests originating from the AVideo server. The UI:N (no user interaction) and low complexity factors increase exploitability once initial access is obtained. However, the PR:L requirement significantly reduces attack surface compared to unauthenticated SSRF vulnerabilities, limiting exposure to insider threats or compromised uploader accounts. SSVC decision framework would classify this as requiring scheduled remediation rather than immediate out-of-band patching unless internal network segmentation is weak or cloud metadata exposure risk is high.

An attacker with a low-privileged uploader account authenticates to the AVideo platform and navigates to the media upload interface. They craft a malicious upload-by-URL request to objects/aVideoEncoder.json.php with downloadURL parameter set to http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name.mp4 (appending .mp4 to bypass extension validation). The AVideo server fetches the AWS instance metadata containing temporary security credentials and stores the JSON response as media content, which the attacker then retrieves through the platform's media access mechanisms. The attacker escalates this into full AWS account compromise by using the exfiltrated credentials to assume the instance's IAM role.