PT-2026-21762 · Avideo · Avideo

Arkmarta · Published 2026-02-24 · Updated 2026-03-01 · CVE-2026-27732

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 22.0

Description AVideo is an open source video platform. The aVideoEncoder.json.php API endpoint accepts a downloadURL parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs, including internal network endpoints, leading to Server-Side Request Forgery (SSRF). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data, potentially leading to further compromise. The vulnerable parameter is downloadURL.

Recommendations Update AVideo to version 22.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27732

GHSA-H39H-7CVG-Q7J6

Affected Products

Avideo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27732.json · Exploit
• https://github.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27732 · Security Note
• https://osv.dev/vulnerability/GHSA-h39h-7cvg-q7j6 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/releases/tag/22.0 · Note
• https://twitter.com/cracbot/status/2028062891010867338 · Twitter Post
• https://twitter.com/CVEnew/status/2026676464977105169 · Twitter Post