EUVD-2026-46120
GHSA-rqr2-9jm2-2q9j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege auth required (PR:L); scope change to internal systems (S:C); blind SSRF enables enumeration (C:L) but no direct write capability (I:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.
AnalysisAI
Blind server-side request forgery in AVideo's encoder download-by-URL flow allows authenticated attackers to probe internal network infrastructure by exploiting an unpinned cURL retry fallback. When the primary DNS-pinned fetch to a supplied downloadURL fails, the application retries with a null resolvedIP argument to ssrfPinnedFetchToFile, stripping the DNS-binding protection and allowing attacker-controlled HTTP redirects to reach RFC-1918 or loopback addresses. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; the CVSS 4.0 score of 5.3 with PR:L reflects a real but bounded risk gated behind authenticated access.
Technical ContextAI
AVideo is a self-hosted, open-source video platform maintained by WWBN on GitHub. The vulnerable code resides in objects/aVideoEncoder.json.php within the downloadVideoFromDownloadURL function. AVideo implements a SSRF defense layer via ssrfPinnedFetchToFile (objects/functions.php) that resolves the target hostname and confirms it maps to a public IP before issuing the cURL request - a DNS-pinning pattern intended to block SSRF to internal ranges. The flaw (CWE-918) arises in the failure-recovery branch: when the pinned fetch returns zero bytes saved, the code retries by calling ssrfPinnedFetchToFile($downloadURL, $temp, null, 7200), passing null as the resolvedIP. The null disables the DNS pin, and cURL FOLLOWLOCATION (if enabled) or the retry target itself can now resolve to an internal address. The commit diff also shows a MIME-type validation block added as a secondary defense - verifying the downloaded file is video, audio, or a recognized archive - but this only prevents content from being stored; the TCP connection to the internal target is still established, making this a blind SSRF primitive. The fix commit additionally adds CURLOPT_CONNECTTIMEOUT to cURL calls in ssrfPinnedFetchToFile.
RemediationAI
Apply the upstream fix available at https://github.com/WWBN/AVideo/commit/0dbadbcaaa1b415c7db078a72dc4b26d9fac0485, which introduces MIME-type validation for downloaded files and adds CURLOPT_CONNECTTIMEOUT to cURL retry attempts. A tagged patched release version is not independently confirmed from available data - operators should pull from master post-commit or monitor the GitHub Security Advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-fr98-mjq9-7jmj for a versioned release. As an immediate compensating control, deploy host-level or network egress firewall rules on AVideo servers that block outbound HTTP and HTTPS connections to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata addresses (169.254.169.254); this prevents the unpinned retry from reaching internal targets regardless of application-layer bypass. Trade-off: egress filtering may block legitimate fetches to private CDN ranges if AVideo is deployed in a hybrid network. Additionally, restrict access to the encoder download-by-URL endpoint to administrator-role accounts only, reducing the exploitable population from all authenticated users to highly privileged ones.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today