Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The LiveLinks proxy endpoint (plugin/LiveLinks/proxy.php) in wwbn/avideo versions up to and including 25.0 does not re-check redirect targets for internal or private addresses, so an unauthenticated remote attacker can use an attacker-controlled HTTP redirect to make the server fetch internal resources such as cloud metadata and RFC1918 services and return their content. No fixed version is listed. Restricting network access to the proxy endpoint is a possible mitigation, but the source does not describe a specific workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.6 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0050, the 43rd percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:25 UTC First seen by agentprime
- 31 Oct 2026, 14:25 UTC Confirmed by OSV