What is the CVSS score of CVE-2026-41060?

CVE-2026-41060 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-41060?

WWBN AVideo version 29.0 and earlier contains a server-side request forgery (SSRF) vulnerability with publicly available exploit code that allows authenticated upload users to access internal network…

How to fix or mitigate CVE-2026-41060?

Within 24 hours, restrict upload permissions in AVideo to essential trusted users only and audit accounts currently holding upload capability, as public exploit code exists; if non-critical or heavily exposed, immediately take the service offline or implement strict network segmentation blocking outbound connections to internal ports. Within 7 days, review AVideo server logs for suspicious uploads targeting non-standard ports or unexpected hostnames, and establish network-level controls to block access to internal resources. Within 30 days, monitor WWBN for a patch release; when available, apply the vendor patch immediately.

WWBN AVideo CVE-2026-41060

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-21 security-advisories@github.com

GHSA-j432-4w3j-3w8j

PHP SSRF Avideo Wwbn

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable low-complexity SSRF requires an authenticated upload user (PR:L); reaching a separate internal service is a scope change (S:C) with read-only exfiltration (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:25 vuln.today

Analysis Generated

Jul 24, 2026 - 05:25 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isSSRFSafeURL() function in objects/functions.php contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.

AnalysisAI

Server-side request forgery in WWBN AVideo 29.0 and earlier lets an authenticated upload-capable user bypass the isSSRFSafeURL() same-domain shortcircuit by supplying the site's own public hostname with a non-standard port, causing the server to fetch arbitrary internal ports and save the response to a web-accessible cache path for full exfiltration. The flaw carries a CVSS 7.7 (scope-changing confidentiality impact) and publicly available exploit code exists via the GitHub Security Advisory, though it is not listed in CISA KEV and EPSS probability is negligible (0.03%, 8th percentile).

Technical ContextAI

The vulnerability lives in objects/functions.php within isSSRFSafeURL(), the PHP guard AVideo uses to vet outbound URLs before url_get_contents() fetches them. A prior fix (commit 40872e529) made the SSRF check unconditional, but the check itself contained a same-origin allowlist that returned true whenever a URL's hostname equaled the configured webSiteRootURL host - comparing only the hostname and never the port, scheme, or path. This is a classic CWE-918 (Server-Side Request Forgery) allowlist-bypass root cause: an origin check that is too coarse. Because parse_url() host matching ignored the port, http(s)://<public-host>:<any-port>/ satisfied the check, letting the server reach any TCP port bound on its own interface. The reachable sink is objects/aVideoEncoder.json.php, where $_REQUEST['downloadURL'] flows through downloadVideoFromDownloadURL() and the fetched body is written under Video::getStoragePath().'cache/tmpFile/'.basename(downloadURL), a directory inside the web-accessible videos storage tree. CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* confirms the affected product line.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit a0156a6398362086390d949190f9d52a823000ba, which extends the same-origin check to require that BOTH hostname and port match webSiteRootURL before allowing the request. If you cannot deploy from source immediately, apply specific compensating controls: restrict who can reach the sink by disabling public/self-service account registration and revoking upload permission from untrusted users (removes the PR:L precondition, at the cost of blocking legitimate uploaders); place the AVideo host so that no sensitive internal services listen on other ports of its interface, or firewall the AVideo server's outbound/loopback access to those ports (breaks the SSRF target but may affect co-located services); and deny web access to the cache/tmpFile/ directory under the videos storage path to block retrieval of exfiltrated responses (prevents the read-back, though the internal fetch may still occur). Track the vendor advisory GHSA-j432-4w3j-3w8j (https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j) for a tagged release and upgrade to it once published.