Authenticated uploaders can supply URLs with allowed media extensions in the downloadURL parameter, bypassing SSRF validation and causing the server to fetch the content. The fetched response is then stored as media, providing the attacker a reliable path to exfiltrate data from internal or protected resources. This pattern represents a classic SSRF flaw (CWE‑918) that can reveal sensitive information through server‑initiated requests.

The software affected is WWBN’s open‑source video platform AVideo. All releases version 26.0 and earlier are vulnerable, especially configurations that permit uploading content via a URL. Deployments running these or older releases are at risk if the upload‑by‑URL feature is enabled.

With a CVSS score of 7.1 the severity is medium‑high. Exploitation requires the attacker to be an authenticated uploader, so the attack surface is narrowed to users with upload privileges. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalogue, indicating that widespread exploitation has not been observed yet. Nonetheless, the incomplete fix for a prior SSRF issue suggests the vulnerability remains exploitable if left unpatched.