CVE-2026-85163: Server-Side Request Forgery (SSRF) in WWBN AVideo

The vulnerability exists in the EPG parser component of WWBN AVideo, introduced in commit c91b5975d. It allows authenticated users with upload privileges to provide an internal URL through the epg_link parameter during video upload. The application validates this parameter only for syntax correctness but does not implement SSRF protection checks before fetching the URL server-side during EPG generation. This enables an attacker to make the server perform arbitrary internal HTTP requests, potentially exposing internal resources or services.

An attacker with authenticated upload permissions can exploit this SSRF vulnerability to make the server fetch arbitrary internal URLs. This could lead to unauthorized access to internal services or data that are not otherwise exposed externally. The CVSS 4.0 base score of 7.1 reflects a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and monitor for suspicious activity related to the epg_link parameter. Implement network-level controls to limit server access to sensitive internal resources. Follow vendor updates for official patches or mitigations.