Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4739 vulnerabilities reference this CWE, most recent first.
GHSA-88QF-P934-H9QG
Vulnerability from github – Published: 2026-03-19 21:30 – Updated: 2026-03-19 21:30
VLAI
Details
Server-side request forgery (ssrf) in Microsoft 365 Copilot's Business Chat allows an authorized attacker to elevate privileges over a network.
Severity
8.9 (High)
{
"affected": [],
"aliases": [
"CVE-2026-26137"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-19T21:17:08Z",
"severity": "HIGH"
},
"details": "Server-side request forgery (ssrf) in Microsoft 365 Copilot\u0027s Business Chat allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-88qf-p934-h9qg",
"modified": "2026-03-19T21:30:24Z",
"published": "2026-03-19T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26137"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26137"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-88W2-CJHC-67M3
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40
VLAI
Details
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.
{
"affected": [],
"aliases": [
"CVE-2020-29166"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-03T13:15:00Z",
"severity": "HIGH"
},
"details": "PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.",
"id": "GHSA-88w2-cjhc-67m3",
"modified": "2022-05-24T17:40:48Z",
"published": "2022-05-24T17:40:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29166"
},
{
"type": "WEB",
"url": "https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d"
},
{
"type": "WEB",
"url": "https://pacsone.net/download.htm"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8975-RXWF-WQ3J
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-16 15:30
VLAI
Details
A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-4200"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:20:04Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-8975-rxwf-wq3j",
"modified": "2026-03-16T15:30:45Z",
"published": "2026-03-16T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4200"
},
{
"type": "WEB",
"url": "https://fx4tqqfvdw4.feishu.cn/docx/K0SjdZTPRo31LExSdlfcC3jwn1c?from=from_copylink"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.351112"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.351112"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.770476"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8977-R7MX-5HVR
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-09-15 00:00
VLAI
Details
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in thein the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2020-35558"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T16:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in thein the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.",
"id": "GHSA-8977-r7mx-5hvr",
"modified": "2022-09-15T00:00:20Z",
"published": "2022-05-24T17:42:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35558"
},
{
"type": "WEB",
"url": "https://cert.vde.com/de-de/advisories/vde-2021-003"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2021-003"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2022-039"
},
{
"type": "WEB",
"url": "https://mbconnectline.com/security-advice"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-899P-4HPJ-22F4
Vulnerability from github – Published: 2022-04-09 00:00 – Updated: 2022-04-16 00:01
VLAI
Details
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2022-22339"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-08T16:15:00Z",
"severity": "HIGH"
},
"details": "IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.",
"id": "GHSA-899p-4hpj-22f4",
"modified": "2022-04-16T00:01:28Z",
"published": "2022-04-09T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22339"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219736"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6565099"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-89FC-CVXQ-Q6PV
Vulnerability from github – Published: 2022-04-08 00:00 – Updated: 2022-04-15 00:00
VLAI
Details
Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2021-36202"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-07T20:15:00Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.",
"id": "GHSA-89fc-cvxq-q6pv",
"modified": "2022-04-15T00:00:59Z",
"published": "2022-04-08T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36202"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-02"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-89H6-69JQ-V92C
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18
VLAI
Details
IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2021-29844"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-27T16:15:00Z",
"severity": "HIGH"
},
"details": "IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
"id": "GHSA-89h6-69jq-v92c",
"modified": "2022-05-24T19:18:56Z",
"published": "2022-05-24T19:18:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29844"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/205205"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6508583"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-89M8-6FH5-PGM5
Vulnerability from github – Published: 2026-07-03 21:31 – Updated: 2026-07-03 21:31
VLAI
Details
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-58278"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T21:17:02Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
"id": "GHSA-89m8-6fh5-pgm5",
"modified": "2026-07-03T21:31:39Z",
"published": "2026-07-03T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58278"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-89P2-5QG7-RJ57
Vulnerability from github – Published: 2025-07-20 15:30 – Updated: 2025-07-20 15:30
VLAI
Details
CWE-918 Server-Side Request Forgery (SSRF)
Severity
8.6 (High)
{
"affected": [],
"aliases": [
"CVE-2025-46385"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-20T15:15:24Z",
"severity": "HIGH"
},
"details": "CWE-918 Server-Side Request Forgery (SSRF)",
"id": "GHSA-89p2-5qg7-rj57",
"modified": "2025-07-20T15:30:28Z",
"published": "2025-07-20T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46385"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-89V5-38XR-9M4J
Vulnerability from github – Published: 2026-03-27 15:47 – Updated: 2026-03-27 15:47
VLAI
Summary
Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
Details
Summary
Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.
Vulnerable Code
1. Webhook Send Endpoint (Most Critical)
apps/backend/src/api/routes/webhooks.controller.ts lines 58-70:
async sendWebhook(@Body() body: any, @Query('url') url: string) {
try {
await fetch(url, { // No URL validation
method: 'POST',
body: JSON.stringify(body),
headers: { 'Content-Type': 'application/json' },
});
} catch (err) { }
return { send: true };
}
Accepts arbitrary URL via query parameter and fetches directly.
2. Stored Webhook Delivery
apps/orchestrator/src/activities/post.activity.ts lines 256-281:
async sendWebhooks(postId: string, orgId: string, integrationId: string) {
const webhooks = await this._webhookService.getWebhooks(orgId);
return Promise.all(
webhooks.map(async (webhook) => {
await fetch(webhook.url, { // Stored URL, no validation
method: 'POST',
body: JSON.stringify(post),
});
})
);
}
3. RSS/XML Feed Parser
libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts line 135:
async loadXML(url: string) {
const { items } = await parser.parseURL(url); // No URL validation
}
4. HTML Content Loader
libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts line 185:
async loadUrl(url: string) {
const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation
}
Missing Protections
- No
request-filtering-agentor SSRF library - No private IP range filtering
- No cloud metadata endpoint blocking
- No DNS rebinding protection
- URL validation only via
@IsUrl()decorator (format only, no IP check)
Attack Scenarios
POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/→ AWS metadata theftPOST /autopost/send?url=http://127.0.0.1:6379→ Internal Redis access- Create webhook with
http://10.0.0.1:8080/admin→ Internal service access on post publish
Impact
- Cloud metadata theft: AWS/GCP/Azure credentials
- Internal network scanning: Full access to private IP ranges
- Multiple entry points: Webhooks, RSS feeds, URL loader all vulnerable
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "postiz"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T15:47:57Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nPostiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.\n\n## Vulnerable Code\n\n### 1. Webhook Send Endpoint (Most Critical)\n\n**`apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70:**\n```typescript\nasync sendWebhook(@Body() body: any, @Query(\u0027url\u0027) url: string) {\n try {\n await fetch(url, { // No URL validation\n method: \u0027POST\u0027,\n body: JSON.stringify(body),\n headers: { \u0027Content-Type\u0027: \u0027application/json\u0027 },\n });\n } catch (err) { }\n return { send: true };\n}\n```\n\nAccepts arbitrary URL via query parameter and fetches directly.\n\n### 2. Stored Webhook Delivery\n\n**`apps/orchestrator/src/activities/post.activity.ts` lines 256-281:**\n```typescript\nasync sendWebhooks(postId: string, orgId: string, integrationId: string) {\n const webhooks = await this._webhookService.getWebhooks(orgId);\n return Promise.all(\n webhooks.map(async (webhook) =\u003e {\n await fetch(webhook.url, { // Stored URL, no validation\n method: \u0027POST\u0027,\n body: JSON.stringify(post),\n });\n })\n );\n}\n```\n\n### 3. RSS/XML Feed Parser\n\n**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135:**\n```typescript\nasync loadXML(url: string) {\n const { items } = await parser.parseURL(url); // No URL validation\n}\n```\n\n### 4. HTML Content Loader\n\n**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185:**\n```typescript\nasync loadUrl(url: string) {\n const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation\n}\n```\n\n## Missing Protections\n\n- No `request-filtering-agent` or SSRF library\n- No private IP range filtering\n- No cloud metadata endpoint blocking\n- No DNS rebinding protection\n- URL validation only via `@IsUrl()` decorator (format only, no IP check)\n\n## Attack Scenarios\n\n1. `POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/` \u2192 AWS metadata theft\n2. `POST /autopost/send?url=http://127.0.0.1:6379` \u2192 Internal Redis access\n3. Create webhook with `http://10.0.0.1:8080/admin` \u2192 Internal service access on post publish\n\n## Impact\n\n- **Cloud metadata theft**: AWS/GCP/Azure credentials\n- **Internal network scanning**: Full access to private IP ranges\n- **Multiple entry points**: Webhooks, RSS feeds, URL loader all vulnerable",
"id": "GHSA-89v5-38xr-9m4j",
"modified": "2026-03-27T15:47:57Z",
"published": "2026-03-27T15:47:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-89v5-38xr-9m4j"
},
{
"type": "WEB",
"url": "https://github.com/gitroomhq/postiz-app/commit/0ad89ccd26b1c387c4f3f3544b18c20d33586466"
},
{
"type": "WEB",
"url": "https://github.com/gitroomhq/postiz-app/commit/be5d871896e97cb1f5a2c9241f156b6a1e1debe8"
},
{
"type": "PACKAGE",
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"type": "WEB",
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.