What is GHSA-wp9x-gmrc-2hg3?

GHSA-wp9x-gmrc-2hg3 is a security advisory published by GitHub Security Advisories with Medium severity. WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side...

Which CVE IDs does GHSA-wp9x-gmrc-2hg3 cover?

GHSA-wp9x-gmrc-2hg3 covers the following CVE IDs: CVE-2026-89242. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wp9x-gmrc-2hg3?

GHSA-wp9x-gmrc-2hg3 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-wp9x-gmrc-2hg3MediumCVSS 7.2

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-89242 →

📋 Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-wqwf-wmvx-53jh
https://nvd.nist.gov/vuln/detail/CVE-2026-89242
https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-ssrf-via-login-json-php
https://github.com/advisories/GHSA-wp9x-gmrc-2hg3