CVE-2026-33024: falha crítica em WWBN AVideo-Encoder
AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.4%
AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
WWBN · AVideo-EncoderCVEs relacionadas — WWBN AVideo-Encoder
No mesmo produto, das mais perigosas para as menos.
CVE-2026-29058CRITICALAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpEPSS 8.9%CVE-2026-61564CRITICALAVideo-Encoder: unauthenticated installer PHP code injectionEPSS 0.5%CVE-2026-61567CRITICALAVideo-Encoder: unauthenticated command execution through streamer login trustEPSS 0.5%CVE-2026-33025HIGHAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY ClauseEPSS 0.4%CVE-2026-61569HIGHAVideo-Encoder: pre-authentication streamer-login SQL injectionEPSS 0.3%CVE-2026-61571HIGHAVideo-Encoder: missing authentication on control and status endpointsEPSS 0.3%