CVE-2026-41060

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41060", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-16T16:43:03.173Z", "datePublished": "2026-04-21T22:44:44.461Z", "dateUpdated": "2026-04-22T14:02:06.458Z"}, "containers": {"cna": {"title": "AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j"}, {"name": "https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba", "tags": ["x_refsource_MISC"], "url": "https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 29.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T22:44:44.461Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue."}], "source": {"advisory": "GHSA-j432-4w3j-3w8j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T14:01:31.813912Z", "id": "CVE-2026-41060", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:02:06.458Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41060", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:01:31.813912Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:01:50.083Z"}}], "cna": {"title": "AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL", "source": {"advisory": "GHSA-j432-4w3j-3w8j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 29.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba", "name": "https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T22:44:44.461Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41060", "state": "PUBLISHED", "dateUpdated": "2026-04-22T14:02:06.458Z", "dateReserved": "2026-04-16T16:43:03.173Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T22:44:44.461Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 29.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA", "versionEndIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 29.0 e inferiores, la funci\u00f3n \u2019isSSRFSafeURL()\u2019 en \u2019objects/functions.php\u2019 contiene un cortocircuito de mismo dominio (l\u00edneas 4290-4296) que permite que cualquier URL cuyo nombre de host coincida con \u2019webSiteRootURL\u2019 omita todas las protecciones SSRF. Debido a que la verificaci\u00f3n compara solo el nombre de host e ignora el puerto, un atacante puede alcanzar puertos arbitrarios en el servidor AVideo utilizando el nombre de host p\u00fablico del sitio con un puerto no est\u00e1ndar. El cuerpo de la respuesta se guarda en una ruta accesible por la web, lo que permite la exfiltraci\u00f3n completa. El commit a0156a6398362086390d949190f9d52a823000ba soluciona el problema."}], "id": "CVE-2026-41060", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41060", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T14:01:31.813912Z", "version": "2.0.3"}}]}, "published": "2026-04-21T23:16:21.250", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,29.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-04-22T06:13:57.083354+00:00", "value": {"mitigation_remediation": ["Apply the official patch from commit a0156a6398362086390d949190f9d52a823000ba to correct the hostname\u2011only check in isSSRFSafeURL().", "If the patch cannot be applied immediately, block non\u2011standard ports at the perimeter firewall or web\u2011server configuration so that only the default HTTP/HTTPS ports are reachable from external hosts.", "Configure the application or infrastructure to reject any upstream request that targets the same domain with a different port, enforcing full host:port validation to prevent the same\u2011domain SSRF bypass."], "summary": {"action": "Immediate Patch", "impact": "Remote server access via SSRF leading to potential data exfiltration"}, "threat_synthesis": {"affected_systems": "The affected product is the open\u2011source video platform AVideo, developed by WWBN. All releases up to version 29.0 contain this vulnerability. No version numbers beyond 29.0 are known to be affected; the fix is included in commit a0156a6398362086390d949190f9d52a823000ba, which should be applied to any installation running an affected version.", "description_and_impact": "An SSRF weakness exists in the AVideo web platform in versions 29.0 and earlier. The isSSRFSafeURL() function performs a same\u2011domain short\u2011circuit that only compares the hostname against webSiteRootURL and ignores the port. Consequently, an attacker can craft a URL that uses the site's public hostname but a non\u2011standard port, causing the application to treat the request as internal. The response body is then written to a location accessible through the web server, allowing the attacker to exfiltrate arbitrary data. This flaw is a classic SSRF flaw (CWE\u2011918) that can lead to data disclosure and other server\u2011side attacks.", "risk_and_exploitability": "With a CVSS score of 7.7, this vulnerability carries a high severity rating. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a web request from an attacker\u2011controlled source that uses the legitimate hostname with a non\u2011standard port. If the attacker can reach the exposed port, the response will be stored on the public file system, enabling complete exfiltration. The presence of an SSRF back\u2011doored function implies that exploitation could be automated and is therefore a high operational risk for any deployed instance that exposes non\u2011standard ports or does not strictly validate the full host:port pair."}}}}, "created": "2026-04-22T03:30:06.537559+00:00", "updated": "2026-04-22T06:15:10.420233+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}