CVE-2026-85163: AVideo Server-Side Request Forgery via epg_link parameter
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have uploader privileges. They can provide a URL through the epg_link parameter while uploading a video.
What systems or data could be exposed?
The affected server can be induced to fetch arbitrary internal URLs during EPG generation. This may expose resources reachable from the AVideo server that are not directly accessible to the attacker.
Does the supplied information identify a fixed version?
No fixed release or version is provided. The affected scope is described as AVideo through commit c91b5975d.
How can administrators determine whether they are affected?
Review the deployed AVideo code version against commit c91b5975d and inspect video-upload handling for use of the epg_link parameter. Affected behavior validates the URL syntactically and later fetches it server-side during EPG generation without SSRF protection checks.