CVE-2026-85164CWE-918ssrf

CVE-2026-85164

High · published September 3, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00328 · 24.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-03T17:06Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-xq33-878j-m9w8 · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-server-side-request-forgery-via-set-api-userimages · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-xq33-878j-m9w8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    WWBN AVideo Server-Side Request Forgery via set_api_userImages
    cvelistv5