PT-2026-26472 · Avideo · Bulkembed+1

Restriction · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33294

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.0

Description The BulkEmbed plugin in AVideo contains a server-side request forgery (SSRF) issue. The save.json.php endpoint within the plugin fetches user-supplied thumbnail URLs using the url get contents() function without proper SSRF protection. This allows an authenticated attacker to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. All other URL-fetching endpoints in AVideo are protected by the isSSRFSafeURL() function, but this code path was missed. The issue allows for a full-read SSRF, where the HTTP response body is written to disk as the video thumbnail and served to the attacker. The API endpoint involved is plugin/BulkEmbed/save.json.php, and the vulnerable parameter is thumbs. Exploitation involves sending a malicious thumbnail URL via the itemsToSave POST parameter. Potential targets include cloud metadata endpoints (AWS, GCP, Azure) and internal network services. Successful exploitation could lead to cloud credential theft, internal network reconnaissance, and data exfiltration.

Recommendations Versions prior to 26.0 should be updated to version 26.0 or later. Add isSSRFSafeURL() validation before the url get contents() call in plugin/BulkEmbed/save.json.php, consistent with all other URL-fetching endpoints.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33294

GHSA-66CW-H2MJ-J39P

Affected Products

Avideo

Bulkembed

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33294.json · Exploit
• https://github.com/WWBN/AVideo/commit/4589a3a089baf4ea439481f5088b38a8aa9c82b6 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-66cw-h2mj-j39p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33294 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33294 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66cw-h2mj-j39p · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/vuldb/status/2035898882086019134 · Twitter Post
• https://twitter.com/CVEnew/status/2035992498900746290 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035786467130130754 · Twitter Post