WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows authenticated users with upload permissions to store arbitrary URLs that the server fetches on every EPG page visit. The URL is validated only with PHP's FILTER_VALIDATE_URL, which accepts internal network addresses. Although AVideo has a dedicated isSSRFSafeURL() function for preventing SSRF, it is not called in this code path. This results in a stored server-side request forgery vulnerability that can be used to scan internal networks, access cloud metadata services, and interact with internal services. At time of publication, there are no publicly available patches.
References
| Link | Resource |
|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-x5vx-vrpf-r45f | Exploit Vendor Advisory |
Configurations
History
01 Apr 2026, 18:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* | |
| First Time |
Wwbn
Wwbn avideo |
|
| References | () https://github.com/WWBN/AVideo/security/advisories/GHSA-x5vx-vrpf-r45f - Exploit, Vendor Advisory |
31 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 21:16
Updated : 2026-04-01 18:43
NVD link : CVE-2026-34740
Mitre link : CVE-2026-34740
CVE.ORG link : CVE-2026-34740
JSON object : View
Products Affected
wwbn
- avideo
CWE
CWE-918
Server-Side Request Forgery (SSRF)