CVE-2026-33294

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

• CWE-918

• https://github.com/WWBN/AVideo/commit/4589a3a089baf4ea439481f5088b38a8aa9c82b6Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-66cw-h2mj-j39pExploit, Vendor Advisory

Published

Mar 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33289SuiteCRM is an open-source, enterprise-ready Customer Relati…9.8
• CVE-2026-3329A remote unauthenticated attacker may be able to conduct cre…7.5
• CVE-2026-33290WPGraphQL provides a GraphQL API for WordPress sites. Prior …4.3
• CVE-2026-33291Discourse is an open-source discussion platform. Prior to ve…5.4
• CVE-2026-33292WWBN AVideo is an open source video platform. Prior to versi…7.5
• CVE-2026-33293WWBN AVideo is an open source video platform. Prior to versi…8.1
• CVE-2026-33295WWBN AVideo is an open source video platform. Prior to versi…5.4
• CVE-2026-33296WWBN AVideo is an open source video platform. Prior to versi…6.1
• CVE-2026-33297WWBN AVideo is an open source video platform. Prior to versi…9.1
• CVE-2026-33298llama.cpp is an inference of several LLM models in C/C++. Pr…7.8
• CVE-2026-33299OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-3330The Form Maker by 10Web plugin for WordPress is vulnerable t…4.9