8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27732

CVE-2026-27732: AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Vulnerability Type

Authenticated Server-Side Request Forgery (SSRF)

Affected Product/Versions

AVideo versions prior to 22 (tested on AVideo 21.x).

Root Cause Summary

The aVideoEncoder.json.php API endpoint accepts a downloadURL parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints).

Impact Summary

An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment.

Resolution/Fix

This issue has been fixed in AVideo version 22. Users should upgrade to version 22.0 as soon as possible.

Credits/Acknowledgement

Thanks to Arkadiusz Marta for responsibly reporting this issue.

GitHub Profile: https://github.com/arkmarta/

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27732

CVE-2026-27732:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 21.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated commit 384ef2548093f4cbb1bfac00f1f429fe57fab853 reveals a Server-Side Request Forgery (SSRF) vulnerability in the AVideo platform. The root cause is the application's failure to properly validate user-supplied URLs before making server-side requests. The vulnerability was not confined to a single function but was a recurring pattern in multiple parts of the codebase where external resources were fetched.

The primary function identified is downloadVideoFromDownloadURL in objects/aVideoEncoder.json.php, which is explicitly mentioned in the vulnerability details. However, the patch shows that the same flaw existed in other files, including objects/aVideoEncoderReceiveImage.json.php, plugin/LiveLinks/proxy.php, and plugin/AI/receiveAsync.json.php. In these cases, various parameters (downloadURL, livelink, etc.) were passed to functions like url_get_contents() or file_get_contents() without sanitization.

The fix involved creating a new, centralized validation function, isSSRFSafeURL(), and applying it in all the identified vulnerable locations. This function checks for and blocks requests to local, private, and other reserved network ranges, thereby mitigating the SSRF risk. For a security engineer, this means that any version of AVideo prior to 22.0 is susceptible to authenticated SSRF attacks through these endpoints, and exploitation would involve an authenticated user making the server fetch a malicious URL.

Vulnerable functions

downloadVideoFromDownloadURL

objects/aVideoEncoder.json.php

The function `downloadVideoFromDownloadURL` in `objects/aVideoEncoder.json.php` was vulnerable to Server-Side Request Forgery (SSRF). It accepted a `downloadURL` parameter and fetched its content using `url_get_contents()` without any validation. This allowed an authenticated attacker to make the server issue requests to arbitrary URLs, including internal network resources. The patch introduced a check using the `isSSRFSafeURL()` function to validate the URL before fetching its content.

objects/aVideoEncoderReceiveImage.json.php

objects/aVideoEncoderReceiveImage.json.php

The script `objects/aVideoEncoderReceiveImage.json.php` handles file uploads from a URL. It was vulnerable to SSRF because it used `url_get_contents()` to fetch images from user-supplied URLs (`downloadURL_image`, `downloadURL_spectrumimage`, `downloadURL_gifimage`, `downloadURL_webpimage`) without proper validation. The patch added calls to `isSSRFSafeURL()` for each of these parameters to mitigate the vulnerability. As the vulnerable code is not within a specific function, the script file itself is the runtime indicator.

plugin/LiveLinks/proxy.php

plugin/LiveLinks/proxy.php

The `proxy.php` script in the LiveLinks plugin was vulnerable to SSRF. It took a `livelink` parameter from the URL and fetched its content without validation. This could be exploited by an attacker to make the server request internal resources. The patch added a check with `isSSRFSafeURL()` at the beginning of the script to block malicious URLs.

plugin/AI/receiveAsync.json.php

plugin/AI/receiveAsync.json.php

The `receiveAsync.json.php` script in the AI plugin was vulnerable to SSRF. It would fetch content from a URL provided in an asynchronous response without validation. An attacker could potentially control this URL to target internal services. The patch added a call to `isSSRFSafeURL()` to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27732: AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Vulnerability Type

Affected Product/Versions

Root Cause Summary

Impact Summary

Resolution/Fix

Credits/Acknowledgement

CVE-2026-27732:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

CVE-2026-27732: AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Vulnerability Type

Affected Product/Versions

Root Cause Summary

Impact Summary

Resolution/Fix

Credits/Acknowledgement

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.1

8.1

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI