PT-2026-29367 · Avideo · Avideo

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and earlier

Description AVideo, an open source video platform, contains a stored server-side request forgery (SSRF) issue in the Electronic Program Guide (EPG) link feature. Authenticated users with upload permissions can store arbitrary URLs, which the server retrieves when an EPG page is visited. The URL validation uses PHP's FILTER VALIDATE URL, which permits internal network addresses. The isSSRFSafeURL() function, designed to prevent SSRF, is not utilized in this specific code path. This allows for potential scanning of internal networks, access to cloud metadata services, and interaction with internal services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-34740

GHSA-X5VX-VRPF-R45F

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34740.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-x5vx-vrpf-r45f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34740 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5vx-vrpf-r45f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34740 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/677d1a314d46abce457c7b662afbb58b0d9f17a2 · Note
• https://twitter.com/CVEnew/status/2039372114831065506 · Twitter Post
• https://twitter.com/cyberbivash/status/2039091843439198719 · Twitter Post