SSRF in Wwbn Avideo
CVE-2026-33766
WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating…
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.000 (10.8th percentile) — read the EPSS interpretation.
Affected products
- Wwbn Avideo — versions <= 26.0
Weakness classification (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf (x_refsource_CONFIRM)
- https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12 (x_refsource_MISC)