CVE-2026-27732 json
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
published 2026-02-24 8 mo ago modified 2026-09-02 2 mo ago also GHSA-h39h-7cvg-q7j6 , EUVD-2026-8527
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.
Patch / fix
- packagist wwbn/avideo 22.0
- wwbn avideo 22.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <22.0 |
22.0 |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853
web, patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6
web, vendor-advisory
-
github.com
/WWBN/AVideo/releases/tag/22.0
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2026-27732
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-27732
- GitHub Advisory GHSA-h39h-7cvg-q7j6
- NVD CVE-2026-27732
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.