PT-2026-26561 · Avideo · Avideo

Danielnetodotcom · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33024

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.0

Description AVideo is a video-sharing platform. Versions prior to 8.0 contain a Server-Side Request Forgery issue (CWE-918) in the public thumbnail endpoints ''getImage.php'' and ''getImageMP4.php''. These endpoints accept a base64Url GET parameter, decode it, and pass the resulting URL to ffmpeg as an input source without authentication. The initial validation only confirmed the URL was syntactically valid and began with http(s)://, which is insufficient. An attacker can provide URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server access internal network resources. The response is not directly returned, but timing differences and error logs can be used to infer results.

Recommendations Versions prior to 8.0 should be updated to version 8.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33024

GHSA-H9GH-866R-6VGQ

Affected Products

Avideo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33024.json · Exploit
• https://github.com/WWBN/AVideo-Encoder/commit/f9df098534a0e05fd431e771ac9d70f0f36f1c06 · Patch
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-h9gh-866r-6vgq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33024 · Security Note
• https://twitter.com/0dayPublishing/status/2034863541287588238 · Twitter Post
• https://twitter.com/CVEnew/status/2034891554456785075 · Twitter Post