Executive brief
WWBN AVideo is an open-source platform used for hosting and sharing video content. A security flaw in the Electronic Program Guide (EPG) feature allows users with video upload permissions to force the server to make unauthorized requests to internal systems. This could allow an attacker to scan private internal networks, access sensitive cloud configuration data, or interact with internal services that are otherwise hidden from the public internet.
Technical details
A stored Server-Side Request Forgery (SSRF) exists in WWBN AVideo versions 26.0 and prior within the Electronic Program Guide (EPG) link feature. The vulnerability occurs because the application uses PHP's FILTER_VALIDATE_URL to validate user-provided EPG links in 'objects/videoAddNew.json.php', which fails to block internal IP addresses. While the application contains a dedicated 'isSSRFSafeURL()' protection function, it is not invoked before the server executes 'file_get_contents()' on the stored URL in 'objects/EpgParser.php'. An authenticated attacker with upload privileges can provide internal addresses (e.g., 127.0.0.1 or 169.254.169.254) to scan internal ports or retrieve cloud metadata. As of publication, no official patch is available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published by maintainer
- 2026-03-31: disclosed: CVE-2026-34740 published to NVD