PT-2026-34205 · Avideo · Avideo

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41060

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description The isSSRFSafeURL() function in objects/functions.php contains a same-domain shortcircuit that allows any URL with a hostname matching webSiteRootURL to bypass Server-Side Request Forgery (SSRF) protections. SSRF is a flaw where an attacker can force a server to make requests to an unintended location. Because the validation process only checks the hostname and ignores the port, an attacker can access arbitrary ports on the server by using the public hostname with a non-standard port. The response body is then saved to a web-accessible path, allowing for full data exfiltration.

Recommendations Update to a version that includes commit a0156a6398362086390d949190f9d52a823000ba. As a temporary workaround, consider restricting access to the isSSRFSafeURL() function until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41060

GHSA-J432-4W3J-3W8J

Affected Products

Avideo

References · 8

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j · Exploit
• https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41060 · Security Note
• https://osv.dev/vulnerability/GHSA-j432-4w3j-3w8j · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/infoflowcloud/status/2048169394245640459 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046871392096825637 · Twitter Post
• https://twitter.com/CVEnew/status/2048168413600878683 · Twitter Post