CVE-2026-33294CWE-918

AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

Medium · published March 22, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-22T16:58Z
EPSS history
Timeline
  • 22 MAR 16:58Z
    AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources
    cvelistv5