CVE-2026-33294
Medium
Description
WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.
SeverityMedium
CVSS5.0
Exploit probability—
ProductWwbn Avideo
PublishedMar 22, 2026
First seenMar 22, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- wwbn avideo26.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wwbn avideo | v < 26.0 | 26.0 |
| wwbn/avideoPackagist | v ≤ 25.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.