High severity8.6NVD Advisory· Published Mar 23, 2026· Updated Jun 17, 2026
CVE-2026-33480
CVE-2026-33480
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the isSSRFSafeURL() function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (::ffff:x.x.x.x). The unauthenticated plugin/LiveLinks/proxy.php endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wwbn/avideoPackagist | <= 26.0 | — |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/WWBN/AVideo/commit/75ce8a579a58c9d4c7aafe453fbced002cb8f373nvdPatchWEB
- github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hhnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-p3gr-g84w-g8hhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33480ghsaADVISORY
News mentions
0No linked articles in our index yet.