CVE-2026-33766: Wwbn/avideo AVideo Has SSRF Protection Bypass Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f359-r3pv-2phf",
  "modified" : "2026-04-08T23:15:59Z",
  "published" : "2026-03-26T18:10:48Z",
  "aliases" : [ "CVE-2026-33766" ],
  "summary" : "AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints",
  "details" : "## Summary\n\n`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.\n\n## Root Cause\n\n**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.\n\n**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP's default `follow_location=1` — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.\n\n**Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161:\n```php\nif (isValidURL($_REQUEST['downloadURL_image']) && isSSRFSafeURL($_REQUEST['downloadURL_image'])) {\n    $content = url_get_contents($_REQUEST['downloadURL_image']);\n```\n\n## Proof of Concept\n\n1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/`\n2. Authenticated user (with upload+edit permissions) triggers image download:\n```\nGET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&...\n```\n3. `isSSRFSafeURL()` resolves `attacker.com` → public IP → passes validation\n4. `url_get_contents()` follows 302 redirect to `169.254.169.254` → SSRF\n\n## Impact\n\n- Cloud metadata access (AWS IMDSv1, GCP, Azure)\n- Internal network service access\n- Bypasses the existing SSRF protection that was added to prevent exactly this class of attack\n\n## Note\n\nThe curl path in `url_get_contents()` does NOT set `CURLOPT_FOLLOWLOCATION` so it is not affected. Only the `file_get_contents` and `wget` fallback paths are vulnerable.\n\n## Suggested Fix\n\nSet `follow_location` to `0` in the stream context and handle redirects manually with re-validation, or add `isSSRFSafeURL()` check inside `url_get_contents()` after resolving the final URL.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "wwbn/avideo"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "26.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33766"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/WWBN/AVideo"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-26T18:10:48Z",
    "nvd_published_at" : "2026-03-27T15:16:58Z"
  }
}