CVE-2026-33766: AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Summary

isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but urlgetcontents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

Root Cause

Check-time: isSSRFSafeURL() at objects/functions.php:4066 resolves the hostname and validates the IP.

Use-time: urlgetcontents() at objects/functions.php:1990 calls filegetcontents() with PHP's default followlocation=1 — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.

Affected endpoint: objects/aVideoEncoderReceiveImage.json.php at lines 67-68, 107-108, 135-136, 160-161: php if (isValidURL($REQUEST['downloadURLimage']) && isSSRFSafeURL($REQUEST['downloadURLimage'])) { $content = urlgetcontents($REQUEST['downloadURLimage']);

Proof of Concept

1. Attacker sets up https://attacker.com/redir to respond with 302 Location: http://169.254.169.254/latest/meta-data/ 2. Authenticated user (with upload+edit permissions) triggers image download: GET /objects/aVideoEncoderReceiveImage.json.php?downloadURLimage=https://attacker.com/redir&... 3. isSSRFSafeURL() resolves attacker.com → public IP → passes validation 4. urlgetcontents() follows 302 redirect to 169.254.169.254 → SSRF

Impact

- Cloud metadata access (AWS IMDSv1, GCP, Azure) - Internal network service access - Bypasses the existing SSRF protection that was added to prevent exactly this class of attack

Note

The curl path in urlgetcontents() does NOT set CURLOPTFOLLOWLOCATION so it is not affected. Only the filegetcontents and wget fallback paths are vulnerable.

Suggested Fix

Set followlocation to 0 in the stream context and handle redirects manually with re-validation, or add isSSRFSafeURL() check inside urlgetcontents() after resolving the final URL.