PHP EUVD-2026-13557

Remote unauthenticated attacker can exploit AVideo versions prior to 8.0 via public endpoints getImage.php or getImageMP4.php by supplying a base64-encoded URL in the base64Url parameter. No authentication, user interaction, or special configuration required. Default installations are vulnerable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates maximum exploitability with network-based attacks requiring low complexity, no privileges, and no user interaction. The high confidentiality and integrity impacts (VC:H/VI:H) reflect the ability to access internal metadata, credentials, and potentially modify internal services. However, real-world risk is moderated by several factors: the SSRF is blind (requiring inference techniques), the vulnerability is in a niche video platform rather than widely deployed infrastructure, no EPSS score is available suggesting limited observed exploitation activity, and it is not listed in CISA KEV indicating no known active exploitation. The availability of a patch in version 8.0 and the GitHub security advisory provide clear remediation paths. This represents a genuine security concern for organizations running vulnerable AVideo instances, particularly in cloud environments where metadata endpoints could expose credentials, but is not an imminent mass-exploitation threat.

An unauthenticated attacker crafts a malicious URL targeting the AWS EC2 metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) and base64-encodes it. They submit this as the base64Url parameter to getImage.php or getImageMP4.php, causing the server's ffmpeg process to make an HTTP request to retrieve IAM credentials, SSH keys, or other sensitive cloud instance metadata. The attacker analyzes response timing differences and error messages to confirm successful requests and extract information about the internal network topology, even though the actual response content is not directly returned.