WWBN AVideo up to 25.x Scheduler.php run server-side request forgery

Summaryinfo

A vulnerability identified as critical has been detected in WWBN AVideo up to 25.x. This issue affects the function run of the file plugin/Scheduler/Scheduler.php. The manipulation leads to server-side request forgery. This vulnerability is referenced as CVE-2026-33237. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in WWBN AVideo up to 25.x. This issue affects the function run of the file plugin/Scheduler/Scheduler.php. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get_contents()` with an admin-configurable `callbackURL` that is validated only by `isValidURL()` (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler's callback URL is never passed through `isSSRFSafeURL()`, which blocks requests to RFC-1918 private addresses, loopback, and cloud metadata endpoints. An admin can configure a scheduled task with an internal network `callbackURL` to perform SSRF against cloud infrastructure metadata services or internal APIs not otherwise reachable from the internet. Version 26.0 contains a patch for the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33237 since 03/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:plugin/Scheduler/Scheduler.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.0 eliminates this vulnerability. Applying the patch df926e500580c2a1e3c70351f0c30f4e15c0fd83 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 25.x

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion