Stored Server-Side Request Forgery in AVideo Video Platform

CVE-2026-34740

What is CVE-2026-34740?

AVideo, an open-source video platform, contains a vulnerability affecting versions 26.0 and prior, where the EPG link feature permits authenticated users with upload permissions to store arbitrary URLs. These URLs are fetched by the server during every EPG page visit, with validation performed solely through PHP's FILTER_VALIDATE_URL, allowing internal network addresses. Although designed to prevent SSRF, the isSSRFSafeURL() function is not invoked within this context, leading to potential exploitation. This vulnerability could enable attackers to scan internal networks, access cloud metadata services, and interact with protected internal services. As of the publication date, there are no publicly available patches to remediate the issue.

References