CVE-2026-34740

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows authenticated users with upload permissions to store arbitrary URLs that the server fetches on every EPG page visit. The URL is validated only with PHP's FILTER_VALIDATE_URL, which accepts internal network addresses. Although AVideo has a dedicated isSSRFSafeURL() function for preventing SSRF, it is not called in this code path. This results in a stored server-side request forgery vulnerability that can be used to scan internal networks, access cloud metadata services, and interact with internal services. At time of publication, there are no publicly available patches.

• CWE-918

• https://github.com/WWBN/AVideo/security/advisories/GHSA-x5vx-vrpf-r45fExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34735The Hytale Modding Wiki is a free service for Hytale mods to…8.7
• CVE-2026-34736Open edX Platform enables the authoring and delivery of onli…5.3
• CVE-2026-34737WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34738WWBN AVideo is an open source video platform. In versions 26…4.3
• CVE-2026-34739WWBN AVideo is an open source video platform. In versions 26…6.1
• CVE-2026-3474The EmailKit – Email Customizer for WooCommerce & WP plugin …4.9
• CVE-2026-34742The Go MCP SDK used Go's standard encoding/json. Prior to ve…8.1
• CVE-2026-34743XZ Utils provide a general-purpose data-compression library …5.3
• CVE-2026-34744Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-34745Fireshare facilitates self-hosted media and link sharing. Pr…9.1
• CVE-2026-34746Payload is a free and open source headless content managemen…7.7
• CVE-2026-34747Payload is a free and open source headless content managemen…8.2