EUVD-2026-277366

fkie_cve-2026-33294

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

GHSA-66cw-h2mj-j39p — AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources

Affected: Packagist: wwbn/avideo

## Summary

The BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail.

## Details

When saving bulk-embedded videos, user-supplied thumbnail URLs from `$_POST['itemsToSave'][x]['thumbs']` flow directly into `url_get_contents()` with no SSRF validation:

**`plugin/BulkEmbed/save.json.php:68-105`** ```php foreach ($_POST['itemsToSave'] as $value) { foreach ($value as $key => $value2) { $value[$key] = xss_esc($value2); // HTML entity encoding — irrelevant for SSRF } // ... $poster = Video::getPathToFile("{$paths['filename']}.jpg"); $thumbs = $value['thumbs']; // ← attacker-controlled URL if (!empty($thumbs)) { $contentThumbs = url_get_contents($thumbs); // ← fetched without SSRF check if (!empty($contentThumbs)) { make_path($poster); $bytes = file_put_contents($poster, $contentThumbs); // ← response saved to disk } } // ... $videos->setStatus('a'); // ← video set to active, thumbnail publicly accessible ```

The `url_get_contents()` function internally calls `isValidURLOrPath()` which only…

Most recent entries from all

EUVD-2026-277366

fkie_cve-2026-33294

GHSA-66cw-h2mj-j39p — AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources