An SSRF weakness exists in the AVideo web platform in versions 29.0 and earlier. The isSSRFSafeURL() function performs a same‑domain short‑circuit that only compares the hostname against webSiteRootURL and ignores the port. Consequently, an attacker can craft a URL that uses the site's public hostname but a non‑standard port, causing the application to treat the request as internal. The response body is then written to a location accessible through the web server, allowing the attacker to exfiltrate arbitrary data. This flaw is a classic SSRF flaw (CWE‑918) that can lead to data disclosure and other server‑side attacks.

The affected product is the open‑source video platform AVideo, developed by WWBN. All releases up to version 29.0 contain this vulnerability. No version numbers beyond 29.0 are known to be affected; the fix is included in commit a0156a6398362086390d949190f9d52a823000ba, which should be applied to any installation running an affected version.

With a CVSS score of 7.7, this vulnerability carries a high severity rating. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a web request from an attacker‑controlled source that uses the legitimate hostname with a non‑standard port. If the attacker can reach the exposed port, the response will be stored on the public file system, enabling complete exfiltration. The presence of an SSRF back‑doored function implies that exploitation could be automated and is therefore a high operational risk for any deployed instance that exposes non‑standard ports or does not strictly validate the full host:port pair.