Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33024 AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php… https://www.cve.org/CVERecord?id=CVE-2026-33024
Post summary
The post discloses that AVideo versions prior to 8.0 are vulnerable to a Server‑Side Request Forgery (CWE‑918) via the getImage.php endpoint, but does not provide a PoC, exploit, or mitigation.
🚨 CVE-2026-33024: AVideo-Encoder has Unauthenticat... Blind SSRF via base64-encoded URLs in thumbnail endpoints = instant cloud metadata access and internal network pivot wi... https://zerodaysignal.com/vulnerability/CVE-2026-33024 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE‑2026‑33024 is disclosed as a blind SSRF in thumbnail endpoints, enabling cloud metadata exposure and internal network pivoting; no PoC, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo-encoder | - | - | - |