CVE-2026-33039: wwbn avideo

csirt@kutim:~/threat-intel/cve/CVE-2026-33039

CVSS 8.6 · High EPSS 0,46%

Kerentanan Server-Side Request Forgery (SSRF) pada wwbn avideo. Skor CVSS 3.1 8.6 (High) menurut github.com.

Deskripsi (NVD)

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.

Rincian

Terbit di NVD: 20 Maret 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
wwbn	avideo	Semua versi sebelum 26.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw exploit · advisory vendor
https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.