WWBN AVideo-Encoder up to 7.x Endpoint getImage.php base64Url server-side request forgery

Summaryinfo

A vulnerability categorized as critical has been discovered in WWBN AVideo-Encoder up to 7.x. This vulnerability affects unknown code of the file getImage.php of the component Endpoint. Executing a manipulation of the argument base64Url can lead to server-side request forgery. This vulnerability is tracked as CVE-2026-33024. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in WWBN AVideo-Encoder up to 7.x. It has been declared as critical. This vulnerability affects an unknown functionality of the file getImage.php of the component Endpoint. The manipulation of the argument base64Url with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-33024 since 03/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:getImage.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.0 eliminates this vulnerability. Applying the patch f9df098534a0e05fd431e771ac9d70f0f36f1c06 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo-Encoder

Version

• 7.x

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo-Encoder/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion