https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 23:53:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277798 EUVD-2026-277798 https://cve.radiocsirt.org/vuln/euvd-2026-277798 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33766 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33766 https://cve.radiocsirt.org/vuln/ghsa-f359-r3pv-2phf <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.</p> <p>## Root Cause</p> <p>**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.</p> <p>**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP&#39;s default `follow_location=1` — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.</p> <p>**Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161: ```php if (isValidURL($_REQUEST[&#39;downloadURL_image&#39;]) &amp;&amp; isSSRFSafeURL($_REQUEST[&#39;downloadURL_image&#39;])) { $content = url_get_contents($_REQUEST[&#39;downloadURL_image&#39;]); ```</p> <p>## Proof of Concept</p> <p>1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/` 2. Authenticated user (with upload+edit permissions) triggers image download: ``` GET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&amp;... ``` 3. `isSSRFSafeURL()` resolves `attacker.com` → public IP → passes validation 4. `url_get_contents()` follows 302 redirect to `169.254.169.254` → SSRF</p> <p>## Impact</p> <p>- Cloud metadata access (AWS IMDSv1, GCP, Azure) - Internal netwo…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.</p> <p>## Root Cause</p> <p>**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.</p> <p>**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP&#39;s default `follow_location=1` — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.</p> <p>**Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161: ```php if (isValidURL($_REQUEST[&#39;downloadURL_image&#39;]) &amp;&amp; isSSRFSafeURL($_REQUEST[&#39;downloadURL_image&#39;])) { $content = url_get_contents($_REQUEST[&#39;downloadURL_image&#39;]); ```</p> <p>## Proof of Concept</p> <p>1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/` 2. Authenticated user (with upload+edit permissions) triggers image download: ``` GET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&amp;... ``` 3. `isSSRFSafeURL()` resolves `attacker.com` → public IP → passes validation 4. `url_get_contents()` follows 302 redirect to `169.254.169.254` → SSRF</p> <p>## Impact</p> <p>- Cloud metadata access (AWS IMDSv1, GCP, Azure) - Internal netwo…</p> https://cve.radiocsirt.org/vuln/ghsa-f359-r3pv-2phf