The vulnerability in WWBN AVideo (<= 26.0) arises from improper validation of URLs stored via the EPG link feature. Although a function to prevent SSRF exists, it is not invoked, allowing authenticated users with upload permissions to inject URLs that the server fetches on page load. The URL validation relies solely on FILTER_VALIDATE_URL, which permits internal IP addresses, enabling SSRF attacks that can probe internal networks and access sensitive internal services. This is classified as CWE-918 (Server-Side Request Forgery). No official fixes or patches have been released as of the publication date.

Successful exploitation allows an authenticated user with upload permissions to cause the server to make arbitrary HTTP requests to internal network resources. This can lead to unauthorized internal network scanning and access to sensitive internal services such as cloud metadata endpoints. The vulnerability does not impact confidentiality directly via data exfiltration from the server but poses a significant risk of internal network reconnaissance and potential further exploitation. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and required privileges.

At the time of publication, no official patch or fix is available for this vulnerability. Users should monitor the vendor's advisories for updates. As a temporary mitigation, restrict upload permissions to trusted users only and consider network-level controls to limit the server's ability to access internal or sensitive network resources. Review and modify the code to ensure the isSSRFSafeURL() function is properly called to validate URLs before fetching. Avoid exposing the EPG link feature to untrusted users until a fix is released.