AVideo includes a stored SSRF flaw in its EPG link feature. Authenticated users with upload rights can persist any URL. The server fetches the URL each time an EPG page is viewed, but the code only applies basic URL validation and does not run the dedicated isSSRFSafeURL() check. As a result the system can be made to request arbitrary internal or cloud‑metadata addresses, allowing an attacker to scan the private network, pull metadata, or communicate with internal services. The weakness is classified as CWE‑918.

The product affected is WWBN AVideo, versions 26.0 and earlier. Users who have upload permission in these releases are able to exploit the flaw.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is below 1 %, so widespread exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploit. Completion of the attack path requires legitimate authentication with upload rights, after which the attacker can cause the server to visit attacker‑controlled URLs. If the target network hosts services that respond to these requests, sensitive internal information can be exposed or services can be abused.