CVE-2026-39370: SSRF in AVideo Video Platform

An attacker exploiting this SSRF vulnerability can leverage the upload-by-URL feature to exfiltrate data from internal services or external resources that AVideo has access to. By crafting malicious downloadURL values with common media extensions (e.g., .mp4, .zip), the attacker can trick the server into fetching and storing responses as media content. This effectively turns the upload process into a covert channel for data exfiltration. The potential impact includes exposure of internal network configurations, sensitive data stored in internal databases, or even unauthorized access to external resources.

1. Reserved2026-04-06
2. Published2026-04-07
3. Modified2026-04-08
4. EPSS updated2026-04-15

The primary mitigation for CVE-2026-39370 is to upgrade AVideo to version 26.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting network access for the AVideo server to only necessary resources, implementing strict input validation on the downloadURL parameter to prevent malicious characters or unexpected extensions, and monitoring AVideo logs for suspicious activity. After upgrading, confirm the fix by attempting an upload with a known malicious URL and verifying that the server does not fetch the response.