AVideo-Encoder versions earlier than 8.0 expose a blind SSRF vulnerability in the public thumbnail generators getImage.php and getImageMP4.php. The endpoints accept a base64‑encoded URL, decode it, and pass the resulting address directly to ffmpeg without proper validation or authentication. The only previous check ensured the URL was syntactically valid and started with http(s)://, which is insufficient. An attacker can supply URLs pointing to internal networks or cloud instance metadata, such as http://169.254.169.254/latest/meta-data/, http://192.168.x.x/, or http://127.0.0.1/. Although the server’s response is not returned to the attacker (blind), timing differences and error logs can be leveraged to infer success, thus enabling covert reconnaissance or further exploitation. The vulnerability, categorized as CWE‑918, poses a significant risk of unauthorized internal access.

The affected product is AVideo‑Encoder from WWBN. All releases prior to version 8.0 are vulnerable. No specific sub‑versions are listed beyond the general version boundary. Users running any older version of the encoder should consider this finding applicable.

The CVSS score of 9.3 indicates a very high severity, and the EPSS score of less than 1% suggests low current exploit prevalence. The flaw is not listed in CISA’s KEV catalog, but its unrestricted SSRE nature and high score warrant urgent attention. Exploitation requires only a crafted HTTP request to the public thumbnail endpoint; no authentication or advanced techniques are required. If successful, attackers can enumerate internal network resources or access protected metadata services, potentially paving the way for broader compromise.