CVE-2026-33351

The `$_REQUEST['webSiteRootURL']` parameter is accepted directly from the HTTP request and without any validation, authentication, or allowlist is passed to the `file_get_contents()` function, which executes a request to the specified URL on the server side. The vulnerability occurs only when the AVideo Live plugin is deployed in standalone mode — which is the recommended configuration for this file. The lack of request origin control mechanisms means that any anonymous network user can fully control the target of the query executed by the server.

An attacker can exploit the server as a proxy to query internal network resources (e.g., cloud metadata, internal services inaccessible from outside) and to read and potentially modify data available through these resources, which translates to high risk of confidentiality and integrity breach.

WWBN AVideo should be updated to version 26.0, which contains a patch resolving the issue. The patch is available in the GitHub repository under commit d0c54960389eeb85e76caed5a257ae90e6a739f2.

WWBN AVideo in all versions before 26.0, when the AVideo Live plugin is deployed in standalone mode