CVE-2026-85163 Details
Description
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.
A server-side request forgery (SSRF) vulnerability has been identified in AVideo versions through commit c91b5975d. This vulnerability allows authenticated uploaders to retrieve arbitrary internal URLs. The issue arises in the EPG parser, where the 'epg_link' parameter, validated only for syntax, is used to fetch internal URLs during EPG generation without proper SSRF protection. The vulnerability could be exploited by supplying an internal URL via the 'epg_link' parameter during video upload.
To address this vulnerability, the 'setEpg_link()' function should be modified to include a call to 'isSSRFSafeURL()' to validate the 'epg_link' parameter before it is stored. Additionally, the EPG parser should be updated to check the URL with 'isSSRFSafeURL()' before fetching it with 'url_get_contents()'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-r69x-6mr2-q23v | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-r69x-6mr2-q23v | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/avideo-server-side-request-forgery-via-epg-link-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= c91b5975d |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |