EUVD-2026-277013

fkie_cve-2026-33351

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST['webSiteRootURL']` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.

GHSA-5f7v-4f6g-74rj — AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

Affected: Packagist: wwbn/avideo

### Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST['webSiteRootURL']` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed.

### Affected Component

**File:** `plugin/Live/standAloneFiles/saveDVR.json.php`, lines 5-28

```php $streamerURL = ""; // change it to your streamer URL

$configFile = '../../../videos/configuration.php'; if (file_exists($configFile)) { include_once $configFile; $streamerURL = $global['webSiteRootURL']; }

if (empty($streamerURL) && !empty($_REQUEST['webSiteRootURL'])) { $streamerURL = $_REQUEST['webSiteRootURL']; // ATTACKER-CONTROLLED }

// ...

$verifyURL = "{$streamerURL}plugin/SendRecordedToEncoder/verifyDVRTokenVerification.json.php?saveDVR={$_REQUEST['saveDVR']}"; $result = file_get_contents($verifyURL); // SSRF ```

### Root Cause

1. **User-controlled URL base:** When the configuration file does not exist (standalone deployment), `$streamerURL` is set directly from `$_REQUEST['webSiteRootURL']` with no validation. 2. **No URL allowlisting or scheme restriction:** The value is used as-is in a `file_get_contents()` call. There is no check for `http`/`https` scheme only, no private IP blocking, and no domain allowlist.…

Most recent entries from all

EUVD-2026-277013

fkie_cve-2026-33351

GHSA-5f7v-4f6g-74rj — AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass