AVideo EUVD-2026-78642

No special conditions - remote unauthenticated exploitation against default AVideo deployments through 29.0 (CVSS PR:N/UI:N), requiring only that the instance be network-reachable and that the attacker can reach submitIndex.php or ajax.php with a custom Host header. The specific trigger is the check_site_availability function in those two scripts consuming an attacker-controlled Host header and following redirects. What limits impact: the CVSS vector caps confidentiality at Low with no integrity or availability impact, so the observable result is internal host/port probing rather than direct data exfiltration; the attacker's view is confined to what the AVideo server itself can reach, so instances behind strict egress filtering or on segmented networks with no internal reachability yield little; and any per-request rate limiting, WAF Host-header normalization, or reverse-proxy host allow-listing that rewrites incoming Host values before PHP sees them will block the primitive.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/SC:L, no integrity or availability impact) correctly describes a low-complexity, unauthenticated, network-reachable information-disclosure issue rather than a code-execution bug, and the 6.9 base score is consistent with that. The absence of KEV status, an EPSS score, and any confirmed public exploit means this should be treated as a real but bounded reconnaissance primitive; the danger is chained - SSRF is commonly the first step toward reaching cloud metadata endpoints, admin-only internal services, or an unauthenticated internal API. Note the missing signals explicitly: no EPSS value, no KEV designation, and no POC confirmation were supplied, so the practical prioritization rests on the CVSS vector and asset exposure alone. For a mid-sized operator such as a municipal IT team in rybnik, the decision hinges on whether the AVideo instance can reach internal RFC1918 services - if egress is already restricted, this drops to low urgency; if the platform sits flat inside a trusted network, it is worth patching in the next maintenance window.

An attacker with no credentials sends an HTTP request to /ajax.php or submitIndex.php on a public AVideo instance, setting the Host header to an internal address such as 10.0.0.5:8080 or a metadata service. The server-side check_site_availability routine issues the outbound request and follows any redirects, and the attacker observes the response, status, or timing to determine which internal hosts and ports are alive. Repeated requests enumerate the internal network and can surface unauthenticated internal services for a follow-on attack.