https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 04:37:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276637 EUVD-2026-276637 https://cve.radiocsirt.org/vuln/euvd-2026-276637 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33039 <p>WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.</p> <p>WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33039 https://cve.radiocsirt.org/vuln/ghsa-9x67-f2v7-63rw <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary The `plugin/LiveLinks/proxy.php` endpoint validates user-supplied URLs against internal/private networks using `isSSRFSafeURL()`, but only checks the initial URL. When the initial URL responds with an HTTP redirect (`Location` header), the redirect target is fetched via `fakeBrowser()` without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect.</p> <p>## Affected Component - `plugin/LiveLinks/proxy.php` — lines 38-42 (redirect handling without SSRF re-validation) - `objects/functionsBrowser.php` — `fakeBrowser()` (line 123, raw cURL fetch with no SSRF protections)</p> <p>## Description</p> <p>### Missing SSRF re-validation after HTTP redirect</p> <p>The `proxy.php` endpoint validates the user-supplied `livelink` parameter against internal networks on line 18, using the comprehensive `isSSRFSafeURL()` function (which blocks private IPs, loopback, link-local/metadata, cloud metadata hostnames, and resolves DNS to detect rebinding). However, after calling `get_headers()` on line 38 — which follows HTTP redirects — the code extracts the `Location` header and passes it directly to `fakeBrowser()` without re-applying the SSRF check:</p> <p>```php // plugin/LiveLinks/proxy.php — lines 17-42</p> <p>// SSRF Protection: Block requests to internal/private networks if (!isSSRFSafeURL($_GET[&#39;livelink&#39;])) { // line 18: only checks initial URL _error_log(&#34;LiveLinks proxy: SSRF protection blocked URL: &#34; .…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary The `plugin/LiveLinks/proxy.php` endpoint validates user-supplied URLs against internal/private networks using `isSSRFSafeURL()`, but only checks the initial URL. When the initial URL responds with an HTTP redirect (`Location` header), the redirect target is fetched via `fakeBrowser()` without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect.</p> <p>## Affected Component - `plugin/LiveLinks/proxy.php` — lines 38-42 (redirect handling without SSRF re-validation) - `objects/functionsBrowser.php` — `fakeBrowser()` (line 123, raw cURL fetch with no SSRF protections)</p> <p>## Description</p> <p>### Missing SSRF re-validation after HTTP redirect</p> <p>The `proxy.php` endpoint validates the user-supplied `livelink` parameter against internal networks on line 18, using the comprehensive `isSSRFSafeURL()` function (which blocks private IPs, loopback, link-local/metadata, cloud metadata hostnames, and resolves DNS to detect rebinding). However, after calling `get_headers()` on line 38 — which follows HTTP redirects — the code extracts the `Location` header and passes it directly to `fakeBrowser()` without re-applying the SSRF check:</p> <p>```php // plugin/LiveLinks/proxy.php — lines 17-42</p> <p>// SSRF Protection: Block requests to internal/private networks if (!isSSRFSafeURL($_GET[&#39;livelink&#39;])) { // line 18: only checks initial URL _error_log(&#34;LiveLinks proxy: SSRF protection blocked URL: &#34; .…</p> https://cve.radiocsirt.org/vuln/ghsa-9x67-f2v7-63rw