CVE-2026-33024 is a critical server side request forgery in AVideo Encoder, scored CVSS 9.1. Two public thumbnail endpoints pass a user supplied URL to ffmpeg with no login. The NVD record says it is fixed in 8.0, and the advisory says to update to the latest master commit.
What's affected
The NVD record says versions before 8.0 are affected and that the issue is fixed in 8.0. The GitHub advisory says the fix is on the master branch and tells users to update to the latest master commit. Because the two sources word the fix differently, confirm your build contains the fix commit f9df098 from the record's references.
The affected files are getImage.php and getImageMP4.php, which take a base64 encoded URL parameter. The advisory says earlier validation only checked that the value looked like an http or https URL.
How to check if you're exposed
Find the version or commit of your AVideo Encoder deployment. For a git checkout:
git log --oneline | grep f9df098
If that commit is missing, you do not have the fix.
Then test whether the endpoints are open to the world by reading your web server rules. The advisory says they are only meant to be called by the AVideo front end server, so anything wider than that is more exposure than needed.
What to do now
- Update AVideo Encoder to a build that includes the fix, version 8.0 or the latest master commit.
- Block external access to /objects/getImage.php and /objects/getImageMP4.php at the web server or firewall, and allow only the trusted AVideo site address. The advisory gives this as the quickest mitigation.
- On cloud hosts, require instance metadata tokens, for example IMDSv2 on AWS, so a blind request to the metadata service is much harder to use.
- Limit outbound network access from the encoder to what it needs.
- Review logs and error output for requests with internal addresses.
Why does ffmpeg matter here? It can open network inputs, so handing it a user supplied address turns the server into a fetcher for anything it can reach. The advisory says the original check only confirmed that the value looked like an http or https URL.
The fix resolves the host name from the supplied URL and checks it against the existing private address function, which covers private ranges, loopback and link local addresses, and it also blocks localhost and local names. If you maintain similar code, resolve the name yourself, check the resulting address, and connect to that exact address so a later lookup cannot return something different.
Keep the two endpoints reachable only from the AVideo front end host. The advisory says they are only meant to be called from there.
Why it matters
The class is CWE-918, server side request forgery. The server fetched whatever address it was given. That includes the cloud metadata address, private network ranges and the local host, which an outside user could never reach directly.
The advisory calls the issue blind, meaning the response is not returned. Timing differences and error logs can still reveal what exists. The fix resolves the host name and checks it against private, loopback and link local ranges, and blocks local names. The record's KEV flag is false.
Quick check
If the response is not returned, is it still a problem?
Yes. The advisory says timing differences and error logs can be used to infer results, and the request itself can still reach internal services.
Sources
Last reviewed: 19 October 2026.
