CVE-2026-33237

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get_contents()` with an admin-configurable `callbackURL` that is validated only by `isValidURL()` (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler's callback URL is never passed through `isSSRFSafeURL()`, which blocks requests to RFC-1918 private addresses, loopback, and cloud metadata endpoints. An admin can configure a scheduled task with an internal network `callbackURL` to perform SSRF against cloud infrastructure metadata services or internal APIs not otherwise reachable from the internet. Version 26.0 contains a patch for the issue.

• CWE-918

• https://github.com/WWBN/AVideo/commit/df926e500580c2a1e3c70351f0c30f4e15c0fd83Patch
• https://github.com/WWBN/AVideo/issues/10403
• https://github.com/WWBN/AVideo/security/advisories/GHSA-v467-g7g7-hhfhExploit, Mitigation, Vendor Advisory

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33231NLTK (Natural Language Toolkit) is a suite of open source Py…7.5
• CVE-2026-33232AutoGPT is a workflow automation platform for creating, depl…7.5
• CVE-2026-33233AutoGPT is a workflow automation platform for creating, depl…7.6
• CVE-2026-33234AutoGPT is a workflow automation platform for creating, depl…5
• CVE-2026-33235AutoGPT is a workflow automation platform for creating, depl…7.7
• CVE-2026-33236NLTK (Natural Language Toolkit) is a suite of open source Py…8.1
• CVE-2026-33238WWBN AVideo is an open source video platform. Prior to versi…4.3
• CVE-2026-3324Zohocorp ManageEngine Log360 versions 13000 through 13013 ar…8.2
• CVE-2026-33241Salvo is a Rust web framework. Prior to version 0.89.3, Salv…7.5
• CVE-2026-33242Salvo is a Rust web framework. Versions 0.39.0 through 0.89.…7.5
• CVE-2026-33243barebox is a bootloader. In barebox from version 2016.03.0 t…8.2
• CVE-2026-33244React Router is a router for React. In versions 7.5.1 throug…5.4