https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 11:14:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276936 EUVD-2026-276936 https://cve.radiocsirt.org/vuln/euvd-2026-276936 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33480 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33480 https://cve.radiocsirt.org/vuln/ghsa-p3gr-g84w-g8hh <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services.</p> <p>## Details</p> <p>The `isSSRFSafeURL()` function in `objects/functions.php` (lines 4021-4169) implements SSRF protection with two separate check paths:</p> <p>1. **IPv4 checks** (lines 4101-4134): Regex patterns matching dotted-decimal notation (`/^10\./`, `/^172\./`, `/^192\.168\./`, `/^127\./`, `/^169\.254\./`) 2. **IPv6 checks** (lines 4150-4166): Checks for `::1`, `fe80::/10` (link-local), and `fc00::/7` (unique local)</p> <p>The gap: IPv4-mapped IPv6 addresses (`::ffff:0:0/96`) are not checked in either path. When a URL like `http://[::ffff:169.254.169.254]/` is provided:</p> <p>``` // Line 4038: parse_url strips brackets from IPv6 host $host = parse_url($url, PHP_URL_HOST); // $host = &#34;::ffff:169.254.169.254&#34;</p> <p>// Line 4079: filter_var recognizes it as valid IPv6, skips DNS resolution if (!filter_var($host, FILTER_VALIDATE_IP)) { $resolvedIP = gethostbyname($host); // SKIPPED } $ip = $host; // $ip = &#34;::ffff:169.254.169.254&#34;</p> <p>// Lines 4101-4134: IPv4 regex checks DON&#39;T match (not dotted-decimal) if (preg_match(&#39;/^169\.254\.\d{1,3}\.\d{1,3}$/&#39;, $ip)) // NO MATCH</p> <p>// Lines 4150-4166: IPv6 checks do…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services.</p> <p>## Details</p> <p>The `isSSRFSafeURL()` function in `objects/functions.php` (lines 4021-4169) implements SSRF protection with two separate check paths:</p> <p>1. **IPv4 checks** (lines 4101-4134): Regex patterns matching dotted-decimal notation (`/^10\./`, `/^172\./`, `/^192\.168\./`, `/^127\./`, `/^169\.254\./`) 2. **IPv6 checks** (lines 4150-4166): Checks for `::1`, `fe80::/10` (link-local), and `fc00::/7` (unique local)</p> <p>The gap: IPv4-mapped IPv6 addresses (`::ffff:0:0/96`) are not checked in either path. When a URL like `http://[::ffff:169.254.169.254]/` is provided:</p> <p>``` // Line 4038: parse_url strips brackets from IPv6 host $host = parse_url($url, PHP_URL_HOST); // $host = &#34;::ffff:169.254.169.254&#34;</p> <p>// Line 4079: filter_var recognizes it as valid IPv6, skips DNS resolution if (!filter_var($host, FILTER_VALIDATE_IP)) { $resolvedIP = gethostbyname($host); // SKIPPED } $ip = $host; // $ip = &#34;::ffff:169.254.169.254&#34;</p> <p>// Lines 4101-4134: IPv4 regex checks DON&#39;T match (not dotted-decimal) if (preg_match(&#39;/^169\.254\.\d{1,3}\.\d{1,3}$/&#39;, $ip)) // NO MATCH</p> <p>// Lines 4150-4166: IPv6 checks do…</p> https://cve.radiocsirt.org/vuln/ghsa-p3gr-g84w-g8hh