WWBN AVideo, an open source video platform, contains an SSRF vulnerability in the objects/aVideoEncoder.json.php endpoint in versions 26.0 and prior. The vulnerability allows authenticated users to supply downloadURL values with certain media or archive extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm) that bypass existing SSRF protections. The server fetches the content from these URLs and stores it as media content, effectively turning the upload-by-URL functionality into an SSRF vector capable of response exfiltration. This vulnerability is due to an incomplete remediation of CVE-2026-27732. The CVSS v3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An authenticated uploader can exploit this vulnerability to perform SSRF attacks, potentially accessing internal or protected resources by tricking the server into making arbitrary HTTP requests. The attacker can also exfiltrate response data via the upload-by-URL feature. The confidentiality impact is high, integrity impact is low, and availability is not affected. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict upload-by-URL functionality to trusted users or disable it if possible to reduce risk. Review and enhance SSRF validation logic to properly validate and restrict allowed URLs and file extensions.