What’s Vulnerable › Vulnerabilities

CVE-2026-33294: AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-22 · updated 2026-06-17
• Weakness: CWE-918

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

Affected products

• WWBN AVideo: before 26.0 — fixed in 26.0

How to fix

Upgrade to a fixed version: WWBN AVideo 26.0. Check the vendor advisory for mitigations.

References

• https://github.com/WWBN/AVideo/commit/4589a3a089baf4ea439481f5088b38a8aa9c82b6
• https://github.com/WWBN/AVideo/security/advisories/GHSA-66cw-h2mj-j39p

Get alerted when CVE-2026-33294 or the next vulnerability affects your stack