High severity7.1NVD Advisory· Published Sep 3, 2026

CVE-2026-85164

Description

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WWBN/Avideollm-fuzzy
Range: <c91b5975d

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-xq33-878j-m9w8nvd
www.vulncheck.com/advisories/wwbn-avideo-server-side-request-forgery-via-set-api-userimagesnvd

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000