Advisory details:
github_osv / GHSA-f359-r3pv-2phf
| Advisory ID | github_osv/GHSA-f359-r3pv-2phf |
| Aliases |
CVE-2026-33766
|
| Summary | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints ## Summary `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. ## Root Cause **Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP. **Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP's default `follow_location=1` — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default. **Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161: ```php if (isValidURL($_REQUEST['downloadURL_image']) && isSSRFSafeURL($_REQUEST['downloadURL_image'])) { $content = url_get_contents($_REQUEST['downloadURL_image']); ``` ## Proof of Concept 1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/` 2. Authenticated user (with upload+edit permissions) triggers image download: ``` GET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&... ``` 3. `isSSRFSafeURL()` resolves `attacker.com` → public IP → passes validation 4. `url_get_contents()` follows 302 redirect to `169.254.169.254` → SSRF ## Impact - Cloud metadata access (AWS IMDSv1, GCP, Azure) - Internal network service access - Bypasses the existing SSRF protection that was added to prevent exactly this class of attack ## Note The curl path in `url_get_contents()` does NOT set `CURLOPT_FOLLOWLOCATION` so it is not affected. Only the `file_get_contents` and `wget` fallback paths are vulnerable. ## Suggested Fix Set `follow_location` to `0` in the stream context and handle redirects manually with re-validation, or add `isSSRFSafeURL()` check inside `url_get_contents()` after resolving the final URL. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 4.8 |
| Risk | 2.4 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 5.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-f359-r3pv-2phf/GHSA-f359-r3pv-2phf.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/WWBN/AVideo | ||
| 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 | Other | https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12 |
| CVE-2026-33766 | https://nvd.nist.gov/vuln/detail/CVE-2026-33766 | |
| GHSA-f359-r3pv-2phf | Other | https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-27T14:45:01Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/33xxx/CVE-2026-33766.json
Source Advisory: vulnrichment/CVE-2026-33766
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]