WWBN AVideo versions 29.0 and earlier contain an SSRF vulnerability due to improper validation in the isSSRFSafeURL() function located in objects/functions.php. The function short-circuits SSRF protections for any URL whose hostname matches the webSiteRootURL, ignoring the port number. This allows attackers to send requests to arbitrary ports on the same server, potentially accessing internal services. The server saves the response body to a web-accessible path, enabling attackers to retrieve the response data externally. The vulnerability is tracked as CWE-918 and has a CVSS 3.1 base score of 7.7 (high severity). The issue is fixed in a specific commit referenced in the description.

An attacker with at least low privileges can exploit this SSRF vulnerability to make the server send requests to arbitrary ports on itself, bypassing intended SSRF protections. This can lead to unauthorized access to internal services running on non-standard ports. The exfiltration of response data is possible because the server saves responses to a web-accessible location. The vulnerability does not impact integrity or availability but has high confidentiality impact due to potential data exposure.

A patch fixing this vulnerability is available in commit a0156a6398362086390d949190f9d52a823000ba. Users of WWBN AVideo versions 29.0 and below should upgrade to a version that includes this fix. Since no official vendor advisory or patch link is provided, verify the fix by applying the referenced commit or checking the vendor's repository for updated releases. Until patched, avoid exposing the affected service to untrusted users or networks to reduce risk.