AVideo CVE-2026-56342

Q: What is the CVSS score of CVE-2026-56342?

CVE-2026-56342 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38131 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-20 VulnCheck

PHP SSRF Avideo

6.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Admin authentication required (PR:H); scope changes as the server proxies requests to subsequent internal systems (S:C); full response body returned yields high confidentiality impact; no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:26 vuln.today

Analysis Generated

Jun 22, 2026 - 06:26 vuln.today

DescriptionCVE.org

AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to private IP ranges and cloud metadata endpoints. Attackers can exploit this by crafting requests to internal services, cloud metadata endpoints like 169.254.169.254, and localhost to retrieve sensitive information including IAM credentials, internal service responses, and network configuration details.

AnalysisAI

Full-read SSRF in AVideo through version 27.0 allows authenticated administrators to make the server fetch arbitrary URLs via the statsURL parameter in plugin/Live/test.php, including cloud metadata endpoints and internal network services. The endpoint bypasses the codebase's own isSSRFSafeURL() guard - used in seven other endpoints - and returns full response bodies in the HTML output, enabling retrieval of IAM credentials from cloud metadata services such as 169.254.169.254, internal service data, and network configuration details. No public exploit code has been formally labeled as proof-of-concept, but the GHSA advisory discloses the complete vulnerable code path with all three sink functions (file_get_contents, curl_exec, wget), making exploitation trivial for any party who has read the advisory.

Technical ContextAI

AVideo (CPE: cpe:2.3:a:avideo:avideo:*:*:*:*:*:*:*:*) is a PHP-based video platform. The vulnerable endpoint plugin/Live/test.php accepts a user-supplied URL in the statsURL parameter and passes it to one of three HTTP fetch sinks: file_get_contents(), curl_exec(), or wget, in that order of availability. The only input filter is a trivial regex preg_match('/^http/', $statsURL), which confirms the URL begins with 'http' but performs no host resolution, IP range blocking, or scheme restriction beyond that. The root cause is CWE-918 (Server-Side Request Forgery): the server makes outbound HTTP requests to attacker-controlled destinations using its own network identity and credentials. The codebase already contains isSSRFSafeURL() at objects/functions.php:4025, which resolves DNS to IP addresses and blocks private/reserved ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, and IPv6 equivalents); this function is called in seven other endpoints but is absent from test.php. Additionally, both the curl handler and the file_get_contents stream context disable SSL certificate verification (CURLOPT_SSL_VERIFYHOST=0, CURLOPT_SSL_VERIFYPEER=0), introducing a secondary MITM risk when the server fetches HTTPS targets. All three code paths echo the full response body to the HTML output via _log(), completing a full-read SSRF.

RemediationAI

The upstream fix commit c95eafbdfccd5959c546a430c32fb3b6026f39ac on the WWBN/AVideo GitHub repository patches the vulnerable endpoint; however, as of the time of this analysis, no tagged release incorporating this commit has been confirmed - the Composer package lists 'fixed in: None', making this an upstream fix available via commit only. Organizations should monitor the GHSA advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjx-r2j2-96fx for a patched release and apply it immediately when available. As an interim compensating control, restrict administrative access to AVideo to the minimum necessary set of trusted personnel and enforce MFA on admin accounts, since the attack requires authenticated admin credentials. For cloud-deployed instances where the primary risk is IAM credential theft via 169.254.169.254, consider applying IMDSv2-only enforcement at the cloud provider level (e.g., AWS IMDSv2 hop limit of 1), which blocks server-side metadata requests from application-layer code without affecting legitimate instance metadata usage. Web application firewall rules can be configured to block requests to plugin/Live/test.php from all non-internal management IP ranges as an additional layer. Note that disabling the Live plugin entirely removes the attack surface at the cost of live streaming functionality.