CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-9RXX-66Q3-QPFV
Vulnerability from github – Published: 2026-01-24 09:30 – Updated: 2026-01-24 09:30The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint.
{
"affected": [],
"aliases": [
"CVE-2026-0807"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-24T08:16:07Z",
"severity": "HIGH"
},
"details": "The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the \u0027url\u0027 parameter in the \u0027template_proxy\u0027 function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the \u0027/template-proxy/\u0027 and \u0027/proxy-image/\u0027 endpoint.",
"id": "GHSA-9rxx-66q3-qpfv",
"modified": "2026-01-24T09:30:26Z",
"published": "2026-01-24T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0807"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/tags/1.1.4/includes/Admin/Admin.php#L910"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/trunk/includes/Admin/Admin.php#L910"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3444616"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V5P-4VVQ-FQ48
Vulnerability from github – Published: 2025-08-28 15:30 – Updated: 2026-04-01 18:36Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through 0.4.2.
{
"affected": [],
"aliases": [
"CVE-2025-48364"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-28T13:15:58Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through 0.4.2.",
"id": "GHSA-9v5p-4vvq-fq48",
"modified": "2026-04-01T18:36:00Z",
"published": "2025-08-28T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48364"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/rajce/vulnerability/wordpress-rajce-plugin-0-4-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V9G-4GHW-XRXX
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-26815"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-10T17:15:00Z",
"severity": "HIGH"
},
"details": "SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.",
"id": "GHSA-9v9g-4ghw-xrxx",
"modified": "2022-05-24T17:34:00Z",
"published": "2022-05-24T17:34:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26815"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2984627"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9VP3-7QWQ-83R9
Vulnerability from github – Published: 2022-03-17 00:00 – Updated: 2022-03-25 13:33A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@frangoteam/fuxa"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-45851"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-25T13:33:46Z",
"nvd_published_at": "2022-03-16T10:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server\u0027s internal environment and services, often potentially leading to the attacker executing commands on the server.",
"id": "GHSA-9vp3-7qwq-83r9",
"modified": "2022-03-25T13:33:46Z",
"published": "2022-03-17T00:00:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45851"
},
{
"type": "PACKAGE",
"url": "https://github.com/frangoteam/FUXA"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=JE1Kcq3iJpc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in FUXA"
}
GHSA-9VWR-WW7H-QVV8
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2022-10-10 19:00WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
{
"affected": [],
"aliases": [
"CVE-2019-17670"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-17T13:15:00Z",
"severity": "HIGH"
},
"details": "WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.",
"id": "GHSA-9vwr-ww7h-qvv8",
"modified": "2022-10-10T19:00:18Z",
"published": "2022-05-24T16:59:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17670"
},
{
"type": "WEB",
"url": "https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2"
},
{
"type": "WEB",
"url": "https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html"
},
{
"type": "WEB",
"url": "https://core.trac.wordpress.org/changeset/46472"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00010.html"
},
{
"type": "WEB",
"url": "https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9912"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9W78-79Q7-R4FP
Vulnerability from github – Published: 2026-07-22 22:01 – Updated: 2026-07-22 22:01Impact
Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required.
By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL, defeating the restriction meant to confine requests to the node's own upstream service. With SSRF protection disabled by default (N8N_SSRF_PROTECTION_ENABLED=false), this let an authenticated user make the n8n server issue HTTP requests to arbitrary internal targets.
Patches
The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Set N8N_SSRF_PROTECTION_ENABLED=true to enable SSRF filtering for private IP ranges and cloud metadata endpoints.
- Restrict network egress from the n8n host to limit reachable internal services.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.123.64"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.30.0"
},
{
"fixed": "2.30.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc.0"
},
{
"fixed": "2.29.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65593"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:01:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\n\nEndpoints in `/rest/dynamic-node-parameters/` lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required.\n\nBy supplying an absolute URL in the routing configuration, a caller could override the node type\u0027s declared baseURL, defeating the restriction meant to confine requests to the node\u0027s own upstream service. With SSRF protection disabled by default (`N8N_SSRF_PROTECTION_ENABLED=false`), this let an authenticated user make the n8n server issue HTTP requests to arbitrary internal targets.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Set `N8N_SSRF_PROTECTION_ENABLED=true` to enable SSRF filtering for private IP ranges and cloud metadata endpoints.\n- Restrict network egress from the n8n host to limit reachable internal services.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"id": "GHSA-9w78-79q7-r4fp",
"modified": "2026-07-22T22:01:10Z",
"published": "2026-07-22T22:01:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65593"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access"
}
GHSA-9W8W-FGJG-W972
Vulnerability from github – Published: 2025-01-07 21:30 – Updated: 2026-02-13 18:31I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php
{
"affected": [],
"aliases": [
"CVE-2024-54819"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T20:15:30Z",
"severity": "CRITICAL"
},
"details": "I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php",
"id": "GHSA-9w8w-fgjg-w972",
"modified": "2026-02-13T18:31:21Z",
"published": "2025-01-07T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54819"
},
{
"type": "WEB",
"url": "https://github.com/mkucej/i-librarian-free/commit/ed36f6f258392fa2ec72f9820661ded75d91accc"
},
{
"type": "WEB",
"url": "https://github.com/partywavesec/CVE-2024-55557"
},
{
"type": "WEB",
"url": "https://www.partywave.site/show/research/cve-2024-54819-i-librarian-server-side-request-forgery"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WJQ-F6RC-86WF
Vulnerability from github – Published: 2026-04-08 18:34 – Updated: 2026-07-22 18:31A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
{
"affected": [],
"aliases": [
"CVE-2026-32591"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T18:26:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"id": "GHSA-9wjq-f6rc-86wf",
"modified": "2026-07-22T18:31:45Z",
"published": "2026-04-08T18:34:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21017"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24833"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WR2-VJFC-4JQW
Vulnerability from github – Published: 2022-05-14 01:37 – Updated: 2022-05-14 01:37** DISPUTED ** mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble."
{
"affected": [],
"aliases": [
"CVE-2018-19047"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-07T05:29:00Z",
"severity": "CRITICAL"
},
"details": "** DISPUTED ** mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a \u0027\u003cimg src=\"http://192.168\u0027 substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating \"If you allow users to pass HTML without sanitising it, you\u0027re asking for trouble.\"",
"id": "GHSA-9wr2-vjfc-4jqw",
"modified": "2022-05-14T01:37:22Z",
"published": "2022-05-14T01:37:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19047"
},
{
"type": "WEB",
"url": "https://github.com/mpdf/mpdf/issues/867"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9WR5-VMCV-4R9G
Vulnerability from github – Published: 2026-07-21 00:30 – Updated: 2026-07-21 18:30FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information
{
"affected": [],
"aliases": [
"CVE-2026-51031"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T22:17:15Z",
"severity": "HIGH"
},
"details": "FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information",
"id": "GHSA-9wr5-vmcv-4r9g",
"modified": "2026-07-21T18:30:55Z",
"published": "2026-07-21T00:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51031"
},
{
"type": "WEB",
"url": "https://xinyi234.github.io/2026/04/13/FlareSolverr-Server-Side-Request-Forgery-SSRF-Vulnerability-Report"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.