{"id":"CVE-2026-27732","aliases":["GHSA-h39h-7cvg-q7j6"],"url":"https://o3.security/vulnerability/CVE-2026-27732","summary":"AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php","details":"### Vulnerability Type\nAuthenticated Server-Side Request Forgery (SSRF)\n\n### Affected Product/Versions\nAVideo versions prior to 22 (tested on AVideo 21.x).\n\n### Root Cause Summary\nThe `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints).\n\n### Impact Summary\nAn authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment.\n\n### Resolution/Fix\nThis issue has been fixed in AVideo version 22. Users should upgrade to version 22.0 as soon as possible.\n\n### Credits/Acknowledgement\nThanks to Arkadiusz Marta for responsibly reporting this issue.\n- GitHub Profile: https://github.com/arkmarta/","published":"2026-02-24T14:56:55.372Z","modified":"2026-08-12T03:51:28.584022147Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":"22.0"}],"fix":{"url":"https://github.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853","label":"WWBN/AVideo@384ef25"},"references":[{"type":"WEB","url":"https://github.com/WWBN/AVideo/releases/tag/22.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27732.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27732"},{"type":"FIX","url":"https://github.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:28.584022147Z"}}