AVideo CVE-2026-85163

Exploitation requires an authenticated account with uploader privileges on the target AVideo instance - anonymous or viewer-only users cannot trigger the vulnerable code path. The vulnerability is activated specifically via the epg_link parameter during video upload, which is fetched server-side during EPG generation. Impact scope is bounded by the AVideo server's network position: deployments isolated from internal networks or cloud metadata services have reduced exposure. Deployments that restrict uploader access to a small set of trusted users, or that do not expose the EPG feature, are materially less at risk. Limiting factors: (1) PR:L authenticated requirement eliminates unauthenticated exploitation; (2) no direct code execution - impact is confined to internal URL fetching and HTTP response disclosure; (3) egress filtering on the host can block access to high-value internal targets such as cloud metadata endpoints.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is consistent with the described vulnerability: network-reachable, low complexity, no special attack requirements, uploader-level authentication required, and high confidentiality impact with no integrity or availability effect. The PR:L requirement is the primary risk-reducing factor - exploitation is gated behind a valid uploader account, which meaningfully limits exposure on restricted-access deployments. Risk is highest on multi-tenant or semi-public AVideo instances where uploader accounts are broadly granted, and on instances running in cloud environments where the metadata endpoint is reachable. The SSRF does not directly yield code execution; its primary value to an attacker is internal network reconnaissance and credential harvesting from cloud metadata services. No KEV listing and no public exploit code exist at time of analysis, placing this in a watch-and-patch posture rather than emergency response for most deployments. EPSS data was not provided, so probability of observed exploitation cannot be quantified from the available inputs.

An attacker holding a valid AVideo uploader account submits a video upload request with epg_link set to an internal URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on a cloud-hosted instance. The parameter passes syntactic validation and is stored; when the EPG generation pipeline later runs, the AVideo server fetches the internal endpoint and the attacker retrieves IAM credentials or other sensitive metadata from the server's response or EPG output. No public exploit code has been identified at time of analysis, but the technique is well-understood and requires only standard HTTP tooling and valid uploader credentials.