AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

概要

$resolvedIP = null;
if (isSSRFSafeURL($url, $resolvedIP)) {
    curl_setopt($ch, CURLOPT_RESOLVE, ["$h

参考情報

• WWBN/AVideo security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-45619 · ADVISORY
• WWBN/AVideo · PACKAGE
• GitHub Advisory GHSA-2hch-c97c-g99x · ADVISORY

WWBN/AVideo のその他の脆弱性

• CVE-2026-54458緊急 9.6WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocke…
• CVE-2026-50183中 4.7WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI …
• CVE-2026-50182中 6.1WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo Y…
• CVE-2026-56345高 8.1AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives t…
• CVE-2026-47696中 4.3WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's …