WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.
Cite this page
CVE-2026-41060. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-41060
Use CWE-918, Wwbn vendor hub and Avideo product page to widen CVE-2026-41060 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2026-41064, CVE-2026-41304 and CVE-2026-41055 for nearby disclosures in the same product family.