Is CVE-2026-33024 actively exploited?

No active exploitation of CVE-2026-33024 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33024 be exploited remotely?

Yes. CVE-2026-33024 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33024?

CVE-2026-33024 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-33024

CRITICAL

CVE-2026-33024

CWE-918Published: March 20, 2026· Updated: Mar 24, 2026

9.1

CVSS v3.1

EPSS:0.08%probability of exploitation in 30 daysPercentile:24.1th

Official Description

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.

NVD Source

Technical Analysis

CVE-2026-33024 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.