CVE-2026-85163

AVideo through commit c91b5975d contains a server-side request forgery (SSRF) vulnerability, CWE-918, in its electronic program guide (EPG) parser. An authenticated user with video-upload privileges can supply an attacker-chosen internal URL in the epg_link parameter during upload; the value is checked only for syntax and is later fetched by the server during EPG generation with no SSRF protection checks. Successful abuse lets the attacker make the AVideo server issue requests to internal network resources, potentially exposing internal service responses, cloud metadata endpoints, or the topology of the hosting network (high confidentiality impact per the CVSS 4.0 vector, with no integrity or availability impact). Any AVideo deployment up to commit c91b5975d that grants upload rights to untrusted users is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Inventory any AVideo deployments and restrict video-upload (and therefore epg_link) privileges to trusted users until a fix is available, then upgrade to a release or commit newer than c91b5975d once published. As an interim mitigation, apply egress controls so the AVideo server can only fetch approved EPG hosts and block it from reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254), and review server logs for unexpected outbound requests to internal URLs.