CVE-2026-85163: Wwbn Avideo

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.

Affected products

• Wwbn Avideo

Published 2026-09-03. Last modified 2026-09-08.