CVE-2026-33480HIGH 8.6EPSS p23.5%

CVE-2026-33480CVE-2026-33480

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.

Scoring

CVSS 3.18.6 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS0.32% probability of exploitation · percentile 23.5% · 2026-06-21T12:00:28Z
Published2026-03-23
Last modified2026-03-24

Underlying weaknesses· 1

CWE-918

References

  1. https://github.com/WWBN/AVideo/commit/75ce8a579a58c9d4c7aafe453fbced002cb8f373
  2. https://github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hh

1

TypeTargetConfidenceTier
WeaknessServer-Side Request Forgery (SSRF)cwe-9180%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-33039
CVE
CVE-2026-33502
CVE
CVE-2026-33024
CVE
CVE-2026-27732
CVE
CVE-2026-33716
CVE
CVE-2026-33351
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.