PT-2026-26561 · Avideo · Avideo

Danielnetodotcom · Publicado 2026-03-20 · Atualizado 2026-03-20 · CVE-2026-33024

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.0

Description AVideo is a video-sharing platform. Versions prior to 8.0 contain a Server-Side Request Forgery issue (CWE-918) in the public thumbnail endpoints ''getImage.php'' and ''getImageMP4.php''. These endpoints accept a base64Url GET parameter, decode it, and pass the resulting URL to ffmpeg as an input source without authentication. The initial validation only confirmed the URL was syntactically valid and began with http(s)://, which is insufficient. An attacker can provide URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server access internal network resources. The response is not directly returned, but timing differences and error logs can be used to infer results.

Recommendations Versions prior to 8.0 should be updated to version 8.0.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-33024

GHSA-H9GH-866R-6VGQ

Produtos afetados

Avideo

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33024.json · Exploit
• https://github.com/WWBN/AVideo-Encoder/commit/f9df098534a0e05fd431e771ac9d70f0f36f1c06 · Correção
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-h9gh-866r-6vgq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33024 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2034863541287588238 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034891554456785075 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33024 · Nota de Segurança