AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php (CVE-2026-27732) | HOL Guard CVE

High · CVSS 8.1CVE-2026-27732GHSA-H39H-7CVG-Q7J6

AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Answer in brief

CVE-2026-27732 records a High severity (CVSS 8.1) vulnerability in AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php. The current sources do not mark it as known exploited. The current feed maps wwbn/avideo (composer). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Feb 25, 2026Updated Sep 2, 2026Source checked Sep 2, 2026First seen by HOL Sep 2, 2026Material review Sep 2, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.1
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps wwbn/avideo (composer). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
wwbn/avideocomposer	<=21.0	22.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for wwbn/avideo.
Review the reported fix. Update wwbn/avideo to 22.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Feb 25, 2026
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Sep 2, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Sep 2, 2026

Sources and claim methodology

Upstream source description

### Vulnerability Type Authenticated Server-Side Request Forgery (SSRF) ### Affected Product/Versions AVideo versions prior to 22 (tested on AVideo 21.x). ### Root Cause Summary The `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). ### Impact Summary An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. ### Resolution/Fix This issue has been fixed in AVideo version 22. Users should upgrade to version 22.0 as soon as possible. ### Credits/Acknowledgement Thanks to Arkadiusz Marta for responsibly reporting this issue. - GitHub Profile: https://github.com/arkmarta/

Quoted source text, attributed separately from HOL analysis.