https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T18:04:54.978687+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-290119 EUVD-2026-290119 2026-10-17T18:04:54.981060+00:00 EUVD-2026-290119 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39370 fkie_cve-2026-39370 2026-10-17T18:04:54.981095+00:00

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then fetches the response and stores it as media content. This allows an authenticated uploader to turn the upload-by-URL flow into a reliable SSRF response-exfiltration primitive. The vulnerability is caused by an incomplete fix for CVE-2026-27732.

 https://cve.radiocsirt.org/vuln/ghsa-cmcr-q4jf-p6q9 GHSA-cmcr-q4jf-p6q9 — WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltr… 2026-10-17T18:04:54.981127+00:00

Affected: Packagist: WWBN/AVideo

## Summary

The fix for [CVE-2026-27732](https://github.com/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6) is incomplete.

`objects/aVideoEncoder.json.php` still allows attacker-controlled `downloadURL` values with common media or archive extensions such as `.mp4`, `.mp3`, `.zip`, `.jpg`, `.png`, `.gif`, and `.webm` to bypass SSRF validation. The server then fetches the response and stores it as media content.

This allows an authenticated uploader to turn the upload-by-URL flow into a reliable SSRF response-exfiltration primitive.

## Details

`objects/aVideoEncoder.json.php` accepts attacker-controlled `downloadURL` and passes it to `downloadVideoFromDownloadURL()`.

Inside that function:

1. the URL extension is extracted from the attacker-controlled path 2. the extension is checked against an allowlist of normal encoder formats 3. `isSSRFSafeURL()` is skipped for common media and archive extensions 4. the URL is fetched via `url_get_contents()` 5. the fetched body is written into video storage and exposed through normal media metadata

The current code still contains:

- an extension-based bypass for SSRF validation - no mandatory initial-destination SSRF enforcement inside `url_get_contents()` itself

This means internal URLs such as:

`http://127.0.0.1:9998/probe.mp4`

remain reachable from the application host.

This issue is best described as an incomplete fix / patch bypass of `CVE-2026-27732`, not a separate unrelated SSRF class.

## Proof of concept

1. Log…