Is CVE-2026-34740 actively exploited?

No active exploitation of CVE-2026-34740 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34740 be exploited remotely?

Yes. CVE-2026-34740 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34740?

CVE-2026-34740 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34740

MEDIUM

CVE-2026-34740

CWE-918Published: March 31, 2026· Updated: Apr 1, 2026

6.5

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.6th

Official Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows authenticated users with upload permissions to store arbitrary URLs that the server fetches on every EPG page visit. The URL is validated only with PHP's FILTER_VALIDATE_URL, which accepts internal network addresses. Although AVideo has a dedicated isSSRFSafeURL() function for preventing SSRF, it is not called in this code path. This results in a stored server-side request forgery vulnerability that can be used to scan internal networks, access cloud metadata services, and interact with internal services. At time of publication, there are no publicly available patches.

NVD Source

Technical Analysis

CVE-2026-34740 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.