CVE-2026-33024: critical vulnerability in WWBN AVideo-Encoder
AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.4%
AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
WWBN · AVideo-EncoderRelated CVEs — WWBN AVideo-Encoder
In the same product, most dangerous first.
CVE-2026-29058CRITICALAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpEPSS 8.9%CVE-2026-61564CRITICALAVideo-Encoder: unauthenticated installer PHP code injectionEPSS 0.5%CVE-2026-61567CRITICALAVideo-Encoder: unauthenticated command execution through streamer login trustEPSS 0.5%CVE-2026-33025HIGHAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY ClauseEPSS 0.4%CVE-2026-61569HIGHAVideo-Encoder: pre-authentication streamer-login SQL injectionEPSS 0.3%CVE-2026-61571HIGHAVideo-Encoder: missing authentication on control and status endpointsEPSS 0.3%