CVE-2026-85164 in AVideo
Summary
by MITRE • 09/03/2026
WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability represents a critical server-side request forgery flaw within the WWBN AVideo platform, specifically targeting the set_api_userImages endpoint as introduced in commit c91b5975d. This security defect stems from an insufficient validation mechanism regarding user-supplied input for profileImg and backgroundImg parameters. When authenticated API clients submit requests to update their visual assets, the application fails to rigorously verify that the provided URLs are external or safe before initiating a fetch operation. Instead of restricting access to whitelisted domains or enforcing strict protocol checks, the system blindly trusts these inputs, allowing attackers to manipulate the destination of server-side HTTP requests initiated by the backend service itself.
From an operational perspective, this lack of input validation enables authenticated users to force the application server to make connections to internal network resources that are typically inaccessible from the public internet. By supplying URLs pointing to local host addresses or private IP ranges associated with cloud metadata services such as AWS EC2 instance metadata (169.254.169.254) or Azure managed identity endpoints, an attacker can trigger the server to retrieve sensitive configuration data. The severity of this issue is compounded by the fact that the responses from these internal fetches are written directly to publicly accessible web paths on the application server. This design choice effectively transforms a standard SSRF vulnerability into a potent information disclosure vector, as the retrieved internal data becomes immediately available for download via subsequent HTTP requests without requiring further authentication or complex parsing techniques.
The impact of this vulnerability extends beyond simple network reconnaissance. Attackers can leverage this flaw to exfiltrate cloud provider credentials, API keys, and other sensitive configuration details stored in instance metadata services. This information could subsequently be used to escalate privileges within the cloud environment, potentially leading to full compromise of underlying infrastructure hosting the AVideo service. Furthermore, because the vulnerability requires only authenticated access, it poses a significant risk even against users with low-level permissions who might otherwise have limited capabilities but can still interact with this specific API endpoint. The ability to read arbitrary internal services also opens avenues for further exploitation within isolated network segments if those services are not properly segmented or secured.
This flaw aligns closely with CWE-918, which defines Server-Side Request Forgery as a vulnerability where a web server makes requests based on user-supplied data without proper validation. Additionally, the technique of using SSRF to access cloud metadata is categorized under MITRE ATT&CK T1504.003, specifically Cloud Infrastructure Discovery via Metadata Services. The subsequent retrieval and exposure of this data through publicly accessible paths also relates to CWE-209, which involves the generation of an error message that reveals sensitive information. To mitigate this risk, developers must implement strict allow-listing for URL domains in the set_api_userImages endpoint, ensuring that only approved external image sources are permitted. Furthermore, implementing network-level controls such as egress filtering or disabling metadata service access at the virtual machine level can provide defense-in-depth against SSRF attacks targeting cloud infrastructure.