Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6158 vulnerabilities reference this CWE, most recent first.

GHSA-3X3X-8FFG-GHCV

Vulnerability from github – Published: 2026-07-31 03:31 – Updated: 2026-08-08 00:31
VLAI
Details

A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.

Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
8.0 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-14540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-31T02:16:29Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.",
  "id": "GHSA-3x3x-8ffg-ghcv",
  "modified": "2026-08-08T00:31:09Z",
  "published": "2026-07-31T03:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14540"
    },
    {
      "type": "WEB",
      "url": "https://github.com/googleapis/mcp-toolbox/pull/3448"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3X8W-QFR9-4JMG

Vulnerability from github – Published: 2025-12-15 21:30 – Updated: 2025-12-19 00:31
VLAI
Details

Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-53893"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-15T21:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.",
  "id": "GHSA-3x8w-qfr9-4jmg",
  "modified": "2025-12-19T00:31:41Z",
  "published": "2025-12-15T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53893"
    },
    {
      "type": "WEB",
      "url": "https://www.ateme.com/product-titan-software"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/51582"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ateme-titan-file-authenticated-server-side-request-forgery-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5781.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3XM7-QW7J-QC8V

Vulnerability from github – Published: 2026-03-18 12:59 – Updated: 2026-04-24 20:46
VLAI
Summary
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
Details

Summary

The @aborruso/ckan-mcp-server MCP server provides tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services.

Severity

Attack complexity is HIGH because exploitation requires prompt injection via malicious content (webpage, document) while the victim's AI assistant has this MCP server connected.

Proof of Concept

Tested inside Docker-in-Docker isolated environment with canary HTTP sidecar.

{"tool": "ckan_package_search", "arguments": {"base_url": "http://canary:8080/ssrf", "query": "test"}}

Result: Canary received 9 HTTP requests. The high request volume confirms no rate limiting or URL validation.

Root Cause

No URL validation on base_url parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparql_query and ckan_datastore_search_sql tools also accept arbitrary base URLs and expose injection surfaces.

Impact

Internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the base_url parameter.

Recommended Fix

  1. Validate base_url against a configurable allowlist of permitted CKAN portals
  2. Block private IP ranges (RFC 1918, link-local)
  3. Block cloud metadata endpoints (169.254.169.254)
  4. Sanitize SQL input for datastore queries
  5. SPARQL endpoint allowlist

Credit

Discovered by Andrei Boldyrev of Munio Security Research using munio

Severity
5.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@aborruso/ckan-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.85"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T12:59:42Z",
    "nvd_published_at": "2026-03-20T08:16:11Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `@aborruso/ckan-mcp-server` MCP server provides tools including `ckan_package_search` and `sparql_query` that accept a `base_url` parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services.\n\n## Severity\n\nAttack complexity is HIGH because exploitation requires prompt injection via malicious content (webpage, document) while the victim\u0027s AI assistant has this MCP server connected.\n\n## Proof of Concept\n\nTested inside Docker-in-Docker isolated environment with canary HTTP sidecar.\n\n```json\n{\"tool\": \"ckan_package_search\", \"arguments\": {\"base_url\": \"http://canary:8080/ssrf\", \"query\": \"test\"}}\n```\n**Result**: Canary received **9 HTTP requests**. The high request volume confirms no rate limiting or URL validation.\n\n## Root Cause\n\nNo URL validation on `base_url` parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The `sparql_query` and `ckan_datastore_search_sql` tools also accept arbitrary base URLs and expose injection surfaces.\n\n## Impact\n\nInternal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the `base_url` parameter.\n\n## Recommended Fix\n\n1. Validate `base_url` against a configurable allowlist of permitted CKAN portals\n2. Block private IP ranges (RFC 1918, link-local)\n3. Block cloud metadata endpoints (169.254.169.254)\n4. Sanitize SQL input for datastore queries\n5. SPARQL endpoint allowlist\n\n## Credit\n\nDiscovered by [Andrei Boldyrev](https://github.com/abcgco) of Munio Security Research using [munio](https://munio.dev)",
  "id": "GHSA-3xm7-qw7j-qc8v",
  "modified": "2026-04-24T20:46:15Z",
  "published": "2026-03-18T12:59:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33060"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ondata/ckan-mcp-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks"
}

GHSA-3XQF-MVHG-35J8

Vulnerability from github – Published: 2023-11-28 09:30 – Updated: 2023-12-04 21:30
VLAI
Details

Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-48023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-28T08:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor\u0027s position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment",
  "id": "GHSA-3xqf-mvhg-35j8",
  "modified": "2023-12-04T21:30:51Z",
  "published": "2023-11-28T09:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48023"
    },
    {
      "type": "WEB",
      "url": "https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0"
    },
    {
      "type": "WEB",
      "url": "https://docs.ray.io/en/latest/ray-security/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3XXR-729F-X6V9

Vulnerability from github – Published: 2022-03-15 00:00 – Updated: 2022-03-23 00:00
VLAI
Details

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-39051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-14T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.",
  "id": "GHSA-3xxr-729f-x6v9",
  "modified": "2022-03-23T00:00:48Z",
  "published": "2022-03-15T00:00:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39051"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214441"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6562479"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4233-7Q5Q-M7P6

Vulnerability from github – Published: 2023-11-27 23:30 – Updated: 2023-11-27 23:30
VLAI
Summary
google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability
Details

Summary

A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set a malicious tld, causing the application to return unsafe URLs pointing towards local resources.

Details

The translateOptions.tld field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the translateOptions to set the tld to a payload such as @127.0.0.1. This causes the full URL to become https://translate.google.@127.0.0.1/..., where translate.google. is the username used to connect to localhost.

PoC

Imagine a server running the following code (closely mimicking the code present in the package's README):

const express = require('express');
const { generateRequestUrl, normaliseResponse } = require('google-translate-api-browser');
const https = require('https');

const app = express();
app.use(express.json());

app.post('/translate', async (req, res) => {
    const { text, options } = req.body;

    const url = generateRequestUrl(text, options);

    https.get(url, (resp) => {
        let data = '';

        resp.on('data', (chunk) => {
          data += chunk;
        });

        resp.on('end', () => {
            res.json(normaliseResponse(JSON.parse(data)));
        });
      }).on("error", (err) => {
        console.log("Error: " + err.message);
      });
});

const port = 3000;
app.listen(port, () => {
  console.log(`Server is running on port ${port}`);
});

An attacker can then send the following POST request to /translate:

POST /translate HTTP/1.1
Host: localhost:3000
Content-Type: application/json
Content-Length: 51

{"text":"Hello","options": {"tld": "@127.0.0.1"}  }

This will cause a request to be sent to the localhost of the server running the Node application.

Impact

An attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "google-translate-api-browser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-48711"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-27T23:30:14Z",
    "nvd_published_at": "2023-11-24T17:15:07Z",
    "severity": "LOW"
  },
  "details": "### Summary\nA Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a malicious `tld`, causing the application to return unsafe URLs pointing towards local resources.\n\n### Details\nThe `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as `@127.0.0.1`. This causes the full URL to become `https://translate.google.@127.0.0.1/...`, where `translate.google.` is the username used to connect to localhost.\n\n### PoC\nImagine a server running the following code (closely mimicking the code present in the package\u0027s README):\n```javascript\nconst express = require(\u0027express\u0027);\nconst { generateRequestUrl, normaliseResponse } = require(\u0027google-translate-api-browser\u0027);\nconst https = require(\u0027https\u0027);\n\nconst app = express();\napp.use(express.json());\n\napp.post(\u0027/translate\u0027, async (req, res) =\u003e {\n    const { text, options } = req.body;\n\n    const url = generateRequestUrl(text, options);\n\n    https.get(url, (resp) =\u003e {\n        let data = \u0027\u0027;\n      \n        resp.on(\u0027data\u0027, (chunk) =\u003e {\n          data += chunk;\n        });\n      \n        resp.on(\u0027end\u0027, () =\u003e {\n            res.json(normaliseResponse(JSON.parse(data)));\n        });\n      }).on(\"error\", (err) =\u003e {\n        console.log(\"Error: \" + err.message);\n      });\n});\n\nconst port = 3000;\napp.listen(port, () =\u003e {\n  console.log(`Server is running on port ${port}`);\n});\n```\n\nAn attacker can then send the following POST request to `/translate`:\n```\nPOST /translate HTTP/1.1\nHost: localhost:3000\nContent-Type: application/json\nContent-Length: 51\n\n{\"text\":\"Hello\",\"options\": {\"tld\": \"@127.0.0.1\"}  }\n```\n\nThis will cause a request to be sent to the localhost of the server running the Node application.\n\n### Impact\nAn attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability.\n",
  "id": "GHSA-4233-7q5q-m7p6",
  "modified": "2023-11-27T23:30:14Z",
  "published": "2023-11-27T23:30:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cjvnjde/google-translate-api-browser/security/advisories/GHSA-4233-7q5q-m7p6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48711"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cjvnjde/google-translate-api-browser/commit/33c2eac4a21c6504409e7b06dd16e6346f93d34b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cjvnjde/google-translate-api-browser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability"
}

GHSA-4233-JC72-56C5

Vulnerability from github – Published: 2026-09-30 23:40 – Updated: 2026-09-30 23:40
VLAI
Summary
Astro: Netlify Image CDN allowlist bypass enables SSRF
Details

Summary

The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test(), so an allowed image origin appearing anywhere in a URL, including its path or query string, could satisfy the allowlist.

For example, an application allowing images.example.com could accept a source URL such as:

http://127.0.0.1:6379/?url=https://images.example.com/image.png

The allowlist matched the approved origin in the query string, but Netlify parsed and fetched the URL whose actual host was 127.0.0.1.

Impact

An unauthenticated attacker can bypass the configured image.domains or image.remotePatterns allowlist through the public /.netlify/images endpoint and cause Netlify Image CDN to make requests to attacker-selected URLs. This may allow probing or reaching internal services, depending on Netlify's network-level egress protections.

The Image CDN attempts to transform responses as images, which limits direct response exfiltration. No confidentiality or integrity impact has been demonstrated.

Affected versions

@astrojs/netlify versions from 5.2.0 through 8.2.3.

Patches

Fixed in @astrojs/netlify 8.2.4. Generated remote-image allowlist expressions are now anchored to both the beginning and end of the source URL.

Workarounds

Upgrade to @astrojs/netlify 8.2.4 or later. Before upgrading, disable Netlify Image CDN by setting imageCDN: false in the adapter configuration, or remove remote image allowlist entries.

Credits

Reported by @pacocartones.

Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.2.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@astrojs/netlify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "8.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-625",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T23:40:12Z",
    "nvd_published_at": "2026-09-30T15:22:22Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `@astrojs/netlify` adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with `RegExp.test()`, so an allowed image origin appearing anywhere in a URL, including its path or query string, could satisfy the allowlist.\n\nFor example, an application allowing `images.example.com` could accept a source URL such as:\n\n```text\nhttp://127.0.0.1:6379/?url=https://images.example.com/image.png\n```\n\nThe allowlist matched the approved origin in the query string, but Netlify parsed and fetched the URL whose actual host was `127.0.0.1`.\n\n## Impact\n\nAn unauthenticated attacker can bypass the configured `image.domains` or `image.remotePatterns` allowlist through the public `/.netlify/images` endpoint and cause Netlify Image CDN to make requests to attacker-selected URLs. This may allow probing or reaching internal services, depending on Netlify\u0027s network-level egress protections.\n\nThe Image CDN attempts to transform responses as images, which limits direct response exfiltration. No confidentiality or integrity impact has been demonstrated.\n\n## Affected versions\n\n`@astrojs/netlify` versions from 5.2.0 through 8.2.3.\n\n## Patches\n\nFixed in `@astrojs/netlify` 8.2.4. Generated remote-image allowlist expressions are now anchored to both the beginning and end of the source URL.\n\n## Workarounds\n\nUpgrade to `@astrojs/netlify` 8.2.4 or later. Before upgrading, disable Netlify Image CDN by setting `imageCDN: false` in the adapter configuration, or remove remote image allowlist entries.\n\n## Credits\n\nReported by @pacocartones.",
  "id": "GHSA-4233-jc72-56c5",
  "modified": "2026-09-30T23:40:12Z",
  "published": "2026-09-30T23:40:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102983"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17752"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Astro: Netlify Image CDN allowlist bypass enables SSRF"
}

GHSA-423G-PPH2-4PP5

Vulnerability from github – Published: 2026-05-02 06:30 – Updated: 2026-05-02 06:30
VLAI
Details

The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
4.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-6812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-02T06:16:04Z",
    "severity": "MODERATE"
  },
  "details": "The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-423g-pph2-4pp5",
  "modified": "2026-05-02T06:30:24Z",
  "published": "2026-05-02T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6812"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ona/tags/1.23.2/inc/admin/theme-admin.php#L688"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ona/tags/1.23.2/inc/admin/theme-admin.php#L694"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ona/trunk/inc/admin/theme-admin.php#L688"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ona/trunk/inc/admin/theme-admin.php#L694"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0acb365c-b5f2-4377-875b-69278a8ff96e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-425J-2MFW-73XX

Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35
VLAI
Details

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-28978"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-30T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.",
  "id": "GHSA-425j-2mfw-73xx",
  "modified": "2022-05-24T17:35:15Z",
  "published": "2022-05-24T17:35:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28978"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CantoDAM/Canto-Wordpress-Plugin"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/canto/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.canto.com/integrations/wordpress"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-427P-XGCR-J3HR

Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 21:30
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-25310"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-19T09:16:15Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through \u003c= 2.0.0.",
  "id": "GHSA-427p-xgcr-j3hr",
  "modified": "2026-02-19T21:30:44Z",
  "published": "2026-02-19T18:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25310"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/extend-link/vulnerability/wordpress-extend-link-plugin-2-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list