CVE-2026-91967: AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL
AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders() calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering vulnerable function execution on every video watch page render to probe internal hosts using content-type oracles and timing-based detection.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated AVideo user must have the canUpload permission. That user can save an attacker-controlled URL as a video link.
When is the server-side request triggered?
The vulnerable function executes whenever a page for the affected video is rendered. This can repeatedly cause the server to request the attacker-chosen URL.
What can an attacker learn through the SSRF?
The issue is blind SSRF, but an attacker can probe internal hosts using content-type response behavior and timing-based detection. The available information indicates confidentiality impact, not integrity or availability impact.
Are unauthenticated users or default permissions affected?
The provided information only identifies authenticated users with canUpload permission as capable of exploiting the issue. It does not state whether that permission is enabled by default or whether unauthenticated exploitation is possible.