AVideo Platform Hit by SSRF Vulnerability, Leaking Sensitive Data
CVE Notify is flagging a serious Server-Side Request Forgery (SSRF) vulnerability in the open-source WWBN AVideo platform. Affecting versions 26.0 and prior, the issue stems from an incomplete patch for a previous vulnerability, CVE-2026-27732. The vulnerability lies within objects/aVideoEncoder.json.php, where insufficient validation allows attackers to craft download URLs with common media or archive file extensions. This bypasses SSRF checks, enabling the server to fetch and store arbitrary content, effectively turning an upload-by-URL feature into a data exfiltration tool.
According to CVE Notify, an authenticated uploader can exploit this flaw to reliably extract sensitive server responses. By manipulating the downloadURL parameter, an attacker can trick the AVideo server into making requests to internal or external resources and then capture the responses. This could expose internal network information or other sensitive data that the server has access to, posing a significant risk to system integrity and data confidentiality.
What This Means For You
- Immediately update WWBN AVideo instances to the patched version (26.1 or later) to mitigate the SSRF vulnerability and prevent potential data exfiltration by authenticated users.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.
Web Application Exploitation Attempt — CVE-2026-39370
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-39370 | SSRF | WWBN AVideo versions 26.0 and prior, component: objects/aVideoEncoder.json.php, vulnerability: allows attacker-controlled downloadURL values with common media or archive extensions to bypass SSRF validation, leading to response exfiltration. |
| CVE-2026-39370 | Information Disclosure | WWBN AVideo versions 26.0 and prior, component: objects/aVideoEncoder.json.php, vulnerability: SSRF response-exfiltration primitive due to improper validation of downloadURL. |
| CVE-2026-39370 | Misconfiguration | WWBN AVideo versions 26.0 and prior, component: objects/aVideoEncoder.json.php, vulnerability: incomplete fix for CVE-2026-27732 leading to bypass of SSRF validation. |
Related coverage
Laravel Lang Packages Hijacked to Deploy Credential-Stealing Malware
A supply chain attack has compromised Laravel Lang localization packages, exposing developers to credential-stealing malware. Attackers manipulated GitHub version tags to inject malicious code into...
Daily Security Digest — 2026-05-23
9 curated intelligence stories from 3 sources.
npm Boosts Supply Chain Security with 2FA-Gated Staged Publishing
GitHub has rolled out new controls for npm, significantly enhancing software supply chain security. The Hacker News reports that these features, now generally available, introduce...