CVE-2026-85164

HighCVSS 7.1/10Last modified Sep 8, 2026

Description

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-851659.9n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, oCVE-2026-851666.5n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inliCVE-2026-851676.5n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud FiCVE-2026-851688.8n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list CVE-2026-851698.8n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-suppCVE-2026-85178.8Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage CVE-2026-851706.5n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifyiCVE-2026-851716.5n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodCVE-2026-851726.4n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and FunCVE-2026-851734.3n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated usCVE-2026-851748.8SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timiCVE-2026-851758.8SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),