PT-2026-26561 · Wwbn · Avideo-Encoder

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33024

NVD

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER VALIDATE URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33024

Affected Products

Avideo-Encoder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33024 · Security Note
• https://github.com/WWBN/AVideo-Encoder/commit/f9df098534a0e05fd431e771ac9d70f0f36f1c06 · Note
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-h9gh-866r-6vgq · Note
• https://twitter.com/0dayPublishing/status/2034863541287588238 · Twitter Post