CVE-2026-85163 in AVideo
Summary
by MITRE • 09/03/2026
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in AVideo through commit c91b5975d represents a critical Server-Side Request Forgery (SSRF) flaw located within the Electronic Program Guide parser component of the application architecture. This specific weakness arises from an insufficient validation mechanism applied to user-supplied input during the video upload process. Specifically, when authenticated users with uploader privileges provide metadata for their content, they can manipulate the epg_link parameter to inject arbitrary Uniform Resource Locators. The system currently performs only syntactic validation on this field, ensuring that the provided string resembles a valid URL structure, but it fails to implement semantic or contextual checks that would restrict access to internal network resources. This lack of rigorous input sanitization creates an opening for malicious actors to exploit the server's ability to make outbound HTTP requests on behalf of the application itself.
From a technical perspective, the operational impact is significant because the vulnerability allows attackers to bypass standard perimeter defenses by leveraging the trusted status of the AVideo server. Since the request originates from within the internal network infrastructure, it can often access services that are not exposed to the public internet, such as cloud metadata endpoints, internal database interfaces, or administrative panels for other microservices. The attacker does not need to interact with these internal systems directly; instead, they force the AVideo server to act as a proxy, fetching arbitrary URLs and potentially returning sensitive data in the response if the application logic reflects that information back to the user interface or logs it in an accessible location. This capability effectively neutralizes network segmentation strategies designed to isolate critical backend services from external threats.
This vulnerability aligns with CWE-918, which defines Server-Side Request Forgery as a flaw where a web server fetches a resource specified by the user without validating that request sufficiently. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to T1571, specifically the Non-Standard Port or Internal Service Discovery tactics, depending on how the fetched data is utilized. The exploitation path relies heavily on authentication requirements being met, meaning only users with existing uploader privileges can trigger this condition. However, given that authenticated access is often easier to obtain through credential stuffing or session hijacking compared to exploiting unauthenticated flaws, the risk surface remains substantial for organizations deploying AVideo in production environments without additional compensating controls.
To mitigate this vulnerability, immediate remediation should focus on implementing strict allow-listing mechanisms for URLs processed by the EPG parser. The application must validate not only the syntax of the epg_link parameter but also its destination domain and IP address against a predefined list of permitted external domains. Additionally, developers should enforce network-level restrictions to prevent the server from initiating connections to private IP ranges, such as 10.x.x.x, 172.16.x.x through 172.31.x.x, and 192.168.x.x, which are commonly used for internal services and cloud metadata endpoints like AWS EC2 instance metadata service at 169.254.169.254. Implementing a dedicated proxy layer that inspects outbound traffic can also provide an additional defense-in-depth strategy to block unauthorized SSRF attempts before they reach critical backend infrastructure.