GHSA-66cw-h2mj-j39p: AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources

The BulkEmbed plugin in AVideo has an SSRF vulnerability (server-side request forgery, where an attacker tricks the server into making requests to internal networks) in its thumbnail-fetching code. An authenticated user can supply a malicious URL that forces the server to fetch data from internal resources like cloud metadata services, and the response is saved as a publicly viewable image thumbnail, allowing the attacker to read sensitive information.