Executive brief
WWBN AVideo is an open-source platform used for hosting and managing video content. A security flaw allows users with upload permissions to trick the server into accessing internal network resources that are not intended to be public. By providing a specially crafted web link, an attacker can force the server to download sensitive data from private internal systems and save it as a video file, which the attacker can then view or download.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in objects/aVideoEncoder.json.php due to an incomplete fix for CVE-2026-27732. The application validates URLs via isSSRFSafeURL(), but this check is bypassed if the downloadURL ends in common media or archive extensions (e.g., .mp4, .zip, .jpg). An authenticated uploader can provide an internal URL (such as a loopback address) with one of these extensions; the server then fetches the content via url_get_contents() and stores the response in the video storage directory. This allows the attacker to exfiltrate responses from internal APIs or services by accessing the resulting media URL.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-06: advisory: GitHub Security Advisory GHSA-cmcr-q4jf-p6q9 published
- 2026-04-07: disclosed: CVE-2026-39370 published