Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2026-43884

High
7.7/10

Summary

WWBN AVideo is an open source video platform. In versions through 29.0, two endpoints ('plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php') in AVideo call 'isSSRFSafeURL()' to validate user-supplied URLs, then fetch them using bare 'file_get_contents()' without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since 'isSSRFSafeURL()' only validates the initial URL, the redirect target bypasses all Server-Side Request Forgery (SSRF) protections.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published