Vulnerability-Lookup

GHSA-F359-R3PV-2PHF

Vulnerability from github – Published: 2026-03-26 18:10 – Updated: 2026-04-08 23:15

Summary

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Details

Summary

isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but url_get_contents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

Root Cause

Check-time: isSSRFSafeURL() at objects/functions.php:4066 resolves the hostname and validates the IP.

Use-time: url_get_contents() at objects/functions.php:1990 calls file_get_contents() with PHP's default follow_location=1 — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.

Affected endpoint: objects/aVideoEncoderReceiveImage.json.php at lines 67-68, 107-108, 135-136, 160-161:

if (isValidURL($_REQUEST['downloadURL_image']) && isSSRFSafeURL($_REQUEST['downloadURL_image'])) {
    $content = url_get_contents($_REQUEST['downloadURL_image']);

Proof of Concept

Attacker sets up https://attacker.com/redir to respond with 302 Location: http://169.254.169.254/latest/meta-data/
Authenticated user (with upload+edit permissions) triggers image download:

GET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&...

isSSRFSafeURL() resolves attacker.com → public IP → passes validation
url_get_contents() follows 302 redirect to 169.254.169.254 → SSRF

Impact

Cloud metadata access (AWS IMDSv1, GCP, Azure)
Internal network service access
Bypasses the existing SSRF protection that was added to prevent exactly this class of attack

Note

The curl path in url_get_contents() does NOT set CURLOPT_FOLLOWLOCATION so it is not affected. Only the file_get_contents and wget fallback paths are vulnerable.

Suggested Fix

Set follow_location to 0 in the stream context and handle redirects manually with re-validation, or add isSSRFSafeURL() check inside url_get_contents() after resolving the final URL.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T18:10:48Z",
    "nvd_published_at": "2026-03-27T15:16:58Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.\n\n## Root Cause\n\n**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.\n\n**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP\u0027s default `follow_location=1` \u2014 redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.\n\n**Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161:\n```php\nif (isValidURL($_REQUEST[\u0027downloadURL_image\u0027]) \u0026\u0026 isSSRFSafeURL($_REQUEST[\u0027downloadURL_image\u0027])) {\n    $content = url_get_contents($_REQUEST[\u0027downloadURL_image\u0027]);\n```\n\n## Proof of Concept\n\n1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/`\n2. Authenticated user (with upload+edit permissions) triggers image download:\n```\nGET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir\u0026...\n```\n3. `isSSRFSafeURL()` resolves `attacker.com` \u2192 public IP \u2192 passes validation\n4. `url_get_contents()` follows 302 redirect to `169.254.169.254` \u2192 SSRF\n\n## Impact\n\n- Cloud metadata access (AWS IMDSv1, GCP, Azure)\n- Internal network service access\n- Bypasses the existing SSRF protection that was added to prevent exactly this class of attack\n\n## Note\n\nThe curl path in `url_get_contents()` does NOT set `CURLOPT_FOLLOWLOCATION` so it is not affected. Only the `file_get_contents` and `wget` fallback paths are vulnerable.\n\n## Suggested Fix\n\nSet `follow_location` to `0` in the stream context and handle redirects manually with re-validation, or add `isSSRFSafeURL()` check inside `url_get_contents()` after resolving the final URL.",
  "id": "GHSA-f359-r3pv-2phf",
  "modified": "2026-04-08T23:15:59Z",
  "published": "2026-03-26T18:10:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints"
}

CVE-2026-33766 (GCVE-0-2026-33766)

Vulnerability from cvelistv5 – Published: 2026-03-27 14:31 – Updated: 2026-03-27 14:45

Title

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Summary

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-27 14:45 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/8b7e9dad359…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
WWBN	AVideo	Affected: <= 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33766",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T14:45:01.231351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T14:45:06.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T14:31:06.272Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12"
        }
      ],
      "source": {
        "advisory": "GHSA-f359-r3pv-2phf",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33766",
    "datePublished": "2026-03-27T14:31:06.272Z",
    "dateReserved": "2026-03-23T18:30:14.126Z",
    "dateUpdated": "2026-03-27T14:45:06.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-F359-R3PV-2PHF

Summary

Root Cause

Proof of Concept

Impact

Note

Suggested Fix

CVE-2026-33766 (GCVE-0-2026-33766)

Tags

Sightings

Nomenclature

Related by attack behaviour