CVE-2026-33766: AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

March 26, 2026 (updated April 8, 2026)

isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but url_get_contents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12
github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf
github.com/advisories/GHSA-f359-r3pv-2phf
nvd.nist.gov/vuln/detail/CVE-2026-33766

Code Behaviors & Features

Detect and mitigate CVE-2026-33766 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →