WWBN AVideo, an open source video platform, contains an SSRF vulnerability in versions 26.0 and prior. The endpoint objects/aVideoEncoder.json.php accepts downloadURL parameters with extensions like .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm, which bypass SSRF validation. This allows an authenticated user to cause the server to fetch arbitrary URLs and save the fetched content as media, effectively enabling SSRF response exfiltration. The vulnerability stems from an incomplete remediation of CVE-2026-27732. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No official patch or remediation guidance has been published yet.

An authenticated uploader can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests and store the responses as media content. This can lead to unauthorized disclosure of internal resources or sensitive data accessible to the server. The confidentiality impact is high, while integrity and availability impacts are low or none. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should restrict upload-by-URL functionality to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable endpoint to untrusted users until a fix is released. Follow vendor communications closely for updates on remediation.