Executive brief
AVideo is a popular video platform and management system. The platform allows authenticated users to upload videos with an associated EPG (Electronic Program Guide) feed URL. A vulnerability in the EPG parser allows attackers with upload permissions to supply internal URLs that the server will fetch without proper security checks, potentially exposing cloud metadata services, internal host information, or other sensitive internal services.
Technical details
A server-side request forgery (SSRF) vulnerability exists in AVideo's EPG parser (CWE-918). The vulnerability stems from incomplete SSRF validation in the EPG link storage and fetching process. When a user uploads a video, the epg_link parameter is validated using isValidURL(), which checks only syntax and accepts internal IP ranges. Later, when EPG data is generated, the EpgParser.php calls url_get_contents() on the stored URL without calling isSSRFSafeURL(), allowing the server to fetch arbitrary internal URLs. An authenticated uploader can supply URLs pointing to services like http://169.254.169.254/ (AWS metadata), internal hosts, or loopback addresses. The attack requires upload permissions and triggers via EPG generation (either on-demand or cron), but responses are parsed as XML so blind SSRF is possible.
Affected products
- WWBN AVideo through commit c91b5975d
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory GHSA-r69x-6mr2-q23v published
- 2026-09-03: advisory: CVE-2026-85163 published on NVD