https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 10:09:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292460 EUVD-2026-292460 https://cve.radiocsirt.org/vuln/euvd-2026-292460 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41060 <p>WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site&#39;s public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.</p> <p>WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site&#39;s public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41060 https://cve.radiocsirt.org/vuln/ghsa-j432-4w3j-3w8j <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site&#39;s public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration.</p> <p>## Details</p> <p>Commit `40872e529` fixed an extension-based SSRF bypass by making `isSSRFSafeURL()` unconditional. However, `isSSRFSafeURL()` itself contains a same-domain shortcircuit that returns `true` when the URL&#39;s hostname matches `webSiteRootURL`&#39;s hostname, without validating the port:</p> <p>```php // objects/functions.php:4290-4296 if (!empty($global[&#39;webSiteRootURL&#39;])) { $siteHost = strtolower(parse_url($global[&#39;webSiteRootURL&#39;], PHP_URL_HOST)); if ($host === $siteHost) { _error_log(&#34;isSSRFSafeURL: allowing same-domain request to {$host} (matches webSiteRootURL)&#34;); return true; // Returns immediately — port, path, scheme all unchecked } } ```</p> <p>The attack flow through `objects/aVideoEncoder.json.php`:</p> <p>1. User-supplied `$_REQUEST[&#39;downloadURL&#39;]` is passed to `downloadVideoFromDownloadURL()` at line 166 2. `isSSRFSafeURL()` is called at line 368 — passes due to hostname match 3. `url_get_contents($downloadURL)` fetches the attacker-controlled URL at line 378 4. Response…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site&#39;s public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration.</p> <p>## Details</p> <p>Commit `40872e529` fixed an extension-based SSRF bypass by making `isSSRFSafeURL()` unconditional. However, `isSSRFSafeURL()` itself contains a same-domain shortcircuit that returns `true` when the URL&#39;s hostname matches `webSiteRootURL`&#39;s hostname, without validating the port:</p> <p>```php // objects/functions.php:4290-4296 if (!empty($global[&#39;webSiteRootURL&#39;])) { $siteHost = strtolower(parse_url($global[&#39;webSiteRootURL&#39;], PHP_URL_HOST)); if ($host === $siteHost) { _error_log(&#34;isSSRFSafeURL: allowing same-domain request to {$host} (matches webSiteRootURL)&#34;); return true; // Returns immediately — port, path, scheme all unchecked } } ```</p> <p>The attack flow through `objects/aVideoEncoder.json.php`:</p> <p>1. User-supplied `$_REQUEST[&#39;downloadURL&#39;]` is passed to `downloadVideoFromDownloadURL()` at line 166 2. `isSSRFSafeURL()` is called at line 368 — passes due to hostname match 3. `url_get_contents($downloadURL)` fetches the attacker-controlled URL at line 378 4. Response…</p> https://cve.radiocsirt.org/vuln/ghsa-j432-4w3j-3w8j