CVE-2026-27732

描述

### Vulnerability Type Authenticated Server-Side Request Forgery (SSRF) ### Affected Product/Versions AVideo versions prior to 22 (tested on AVideo 21.x). ### Root Cause Summary The `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). ### Impact Summary An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. ### Resolution/Fix This issue has been fixed in AVideo version 22. Users should upgrade to version 22.0 as soon as possible. ### Credits/Acknowledgement Thanks to Arkadiusz Marta for responsibly reporting this issue. - GitHub Profile: https://github.com/arkmarta/

如何修補 CVE-2026-27732

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2026-27732 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 21.0.0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-27732
• PATCHgithub.com/WWBN/AVideo
• WEBgithub.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853
• WEBgithub.com/WWBN/AVideo/releases/tag/22.0
• WEB