CVE-2026-33024— AVideo 代码问题漏洞

AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.

N/A

服务端请求伪造(SSRF)

AVideo 代码问题漏洞

AVideo是World Wide Broadcast Network开源的一个广播网络创建工具。 AVideo 8.0之前版本存在代码问题漏洞，该漏洞源于getImage.php和getImageMP4.php端点存在服务端请求伪造，可能导致访问内部网络资源。

N/A

N/A