WWBN AVideo présente un contournement de la protection SSRF via une URL de téléchargement autorisée, permettant l'exfiltration de réponses internes (Correction incomplète pour CVE-2026-27732)

An attacker exploiting this SSRF vulnerability can leverage the upload-by-URL feature to exfiltrate data from internal services or external resources that AVideo has access to. By crafting malicious downloadURL values with common media extensions (e.g., .mp4, .zip), the attacker can trick the server into fetching and storing responses as media content. This effectively turns the upload process into a covert channel for data exfiltration. The potential impact includes exposure of internal network configurations, sensitive data stored in internal databases, or even unauthorized access to external resources.

Organizations using AVideo for video hosting and content management are at risk, particularly those with internal services or sensitive data accessible from the AVideo server. Shared hosting environments where multiple users share the same AVideo instance are also at increased risk, as a compromised user account could be used to exploit the vulnerability.

• php: Examine AVideo server access logs for requests to unusual or internal URLs originating from authenticated uploaders.

grep 'downloadURL=[^&]+' /var/log/apache2/access.log | grep 'AVideo'

• php: Check AVideo configuration files for any unusual or overly permissive network settings. • generic web: Monitor AVideo server response headers for unexpected content types or unusual data being served. • generic web: Use a web application firewall (WAF) to block requests containing suspicious URLs or patterns in the downloadURL parameter.

1. 2026-04-07Disclosure

   disclosure

1. Réservé2026-04-06
2. Publiée2026-04-07
3. Modifiée2026-04-08
4. EPSS mis à jour2026-04-15

The primary mitigation for CVE-2026-39370 is to upgrade AVideo to version 26.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting network access for the AVideo server to only necessary resources, implementing strict input validation on the downloadURL parameter to prevent malicious characters or unexpected extensions, and monitoring AVideo logs for suspicious activity. After upgrading, confirm the fix by attempting an upload with a known malicious URL and verifying that the server does not fetch the response.