CVE-2026-34740
Stored SSRF Vulnerability in WWBN AVideo EPG Link Feature
Publication date: 2026-03-31
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 26.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in WWBN AVideo, an open source video platform, specifically in versions 26.0 and prior. It involves the EPG (Electronic Program Guide) link feature, which allows authenticated users with upload permissions to store arbitrary URLs. These URLs are fetched by the server every time the EPG page is visited.
The URL validation uses PHP's FILTER_VALIDATE_URL, which does not prevent internal network addresses from being used. Although there is a function designed to prevent server-side request forgery (SSRF) called isSSRFSafeURL(), it is not applied in this part of the code.
As a result, this leads to a stored SSRF vulnerability, allowing attackers to make the server send requests to internal networks, access cloud metadata services, or interact with internal services.
How can this vulnerability impact me? :
This vulnerability can be exploited to scan internal networks, potentially revealing sensitive internal infrastructure details.
Attackers can access cloud metadata services, which may expose sensitive information such as credentials or configuration data.
It also allows interaction with internal services that are normally not accessible from outside, increasing the risk of further compromise.
What immediate steps should I take to mitigate this vulnerability?
Since there are no publicly available patches at the time of publication, immediate mitigation steps include restricting upload permissions to trusted users only and monitoring or disabling the EPG link feature to prevent storage of arbitrary URLs.
Additionally, reviewing and modifying the code to ensure the isSSRFSafeURL() function is called before fetching URLs can help prevent server-side request forgery.