CVE-2026-45578
📛 CVE Title
(no title)
Description
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 8.8 / 10
- CVSS vector
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.8 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-45578
- Linked Threat
- CVE-2026-45578 — CVE-2026-45578
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-29 14:16:30 UTC
- NVD last modified
- 2026-06-01 18:41:19 UTC
- NVD CVSS v3.1
- 8.8 / 10 HIGH source: security-advisories@github.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0005 (probability of exploitation in next 30 days)
- EPSS percentile
- 16.47% vs all CVEs — higher = more likely to be exploited, as of 2026-06-03
NVD-assigned CWE(s):
CWE-78
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-06-03 19:48 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-33310
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xw67-cg5f-4m2r tenable:github.com
- https://www.first.org/epss/ tenable:www.first.org
- https://nvd.nist.gov/vuln/detail/CVE-2026-45578 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-45578 tenable:www.cve.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xw67-cg5f-4m2r security-advisories@github.com Vendor AdvisoryMitigation
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:bastion.tech
CVE - 2026 -44578 is an unauthenticated SSRF in the Next.js WebSocket upgrade handler. It affects self-hosted Next.js 13.4.13 through 16.2.4 and lets attackers reach cloud metadata services, internal admin panels, and any host on port 80. Here is the technical root cause, how to patch , and how to harden the cloud environment around it. 13 min read·Alban Veauté May 15, 2026
2026-05-26 02:55 UTC -
web:borecraft.com
The "recommended targets" pair (15.5.18 / 16.2.6) is one minor patch above the per- CVE fix called out in the GHSA, and is the version pair that covers the May 7 incomplete- fix follow-up (GHSA-26hh-7cqf-hhc6, an App Router segment-prefetch middleware bypass that was not fully fixed for Turbopack in the May 6 patch ).
2026-05-26 02:55 UTC -
web:github.com
CVE - 2026 -44578 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting self-hosted Next.js applications. Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to internal or external systems.
2026-05-26 02:55 UTC -
web:knightli.com
A concise guide to the high-severity Next.js SSRF vulnerability CVE - 2026 -44578. It affects self-hosted Next.js applications using the built-in Node.js server, where crafted WebSocket upgrade requests can make the server proxy requests to internal or external destinations. Fixed versions are 15.5.16 and 16.2.5.
2026-05-26 02:55 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-26 02:55 UTC -
web:strapi.io
CVE - 2026 -44578 is a pre-auth SSRF in Next.js's WebSocket upgrade handler. Learn what's affected, how it works, and how to patch or mitigate it.
2026-05-26 02:55 UTC -
web:www.appsecmaster.net
CVE - 2026 -44578 SSRF flaw (CVSS 8.6) in self-hosted Next.js lets unauth attackers access cloud metadata & internal secrets. Patch /mitigate now.
2026-05-26 02:55 UTC -
web:www.sentinelone.com
CVE - 2026 -44578 is a server-side request forgery vulnerability in Next.js. Learn about its impact, affected versions, and mitigation methods.
2026-05-26 02:55 UTC -
web:www.sonicwall.com
Next.js WebSocket Upgrade Handler SSRF ( CVE - 2026 -44578) Overview The SonicWall Capture Labs threat research team became aware of a Server-Side Request Forgery vulnerability in Next.js, assessed its impact and developed mitigation measures.
2026-05-26 02:55 UTC -
web:www.tenable.com
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal ...
2026-05-26 02:55 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.