# WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

AVideo's incomplete SSRF fix still skips isSSRFSafeURL for allowlisted media extensions, letting an authenticated uploader fetch internal URLs and persist responses as retrievable media.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: threalwinky
- Disclosed: 2026-04-08
- CVE: CVE-2026-39370
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-cmcr-q4jf-p6q9
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-cmcr-q4jf-p6q9
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:php technique:incomplete-fix technique:source-review vuln:ssrf

**Target:** objects/aVideoEncoder.json.php downloadURL upload-by-URL flow
**Root cause:** downloadVideoFromDownloadURL() extracts the URL extension and skips isSSRFSafeURL() for common media/archive extensions, and url_get_contents() has no mandatory initial-destination SSRF enforcement.
**Steps:**
1. Log in as a low-privilege uploader.
2. Start an internal-only HTTP service, e.g. `http://127.0.0.1:9998/probe.mp4`, and confirm it is not externally reachable.
3. Send `POST /objects/aVideoEncoder.json.php` with `downloadURL=http://127.0.0.1:9998/probe.mp4` and `format=mp4`.
4. If needed, replay against the returned `videos_id` with `first_request=1` so fetched bytes land in the media path.
5. Query `GET /objects/videos.json.php?showAll=1` and recover `videosURL.mp4.url`.
6. Download that media URL and observe the body matches the internal-only response byte-for-byte.
**How found:** Reviewing the patch for CVE-2026-27732 and noticing the extension allowlist still short-circuits isSSRFSafeURL() in downloadVideoFromDownloadURL(), with no enforcement inside url_get_contents().
**Exploitation:** Authenticated uploader supplies a downloadURL ending in an allowlisted extension (.mp4/.jpg/.gif/.zip) pointing at loopback/internal HTTP; server fetches it without SSRF validation, stores the body as media, and the attacker retrieves it via the generated /videos/... URL.
**Insight:** When auditing an SSRF fix, check whether validation is gated on attacker-controlled URL properties like file extension; a media/archive extension allowlist is a classic skip condition, and the sink (url_get_contents) should enforce regardless of call site.

## Proof of concept (copied exactly from the original report)

**Internal-only probe service URL**

```
http://127.0.0.1:9998/probe.mp4
```

**Query to recover exfiltrated media URL**

```
GET /objects/videos.json.php?showAll=1
```