Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4757 vulnerabilities reference this CWE, most recent first.

GHSA-CCFQ-2454-F5XW

Vulnerability from github – Published: 2026-05-12 22:24 – Updated: 2026-06-09 10:32
VLAI
Summary
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
Details

Resolution

SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.

Documentation:

  • https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelisting
  • https://docs.sillytavern.app/administration/#security-checklist

Note on future SSRF findings

Since the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.

Overview

  • Vulnerability Type: SSRF
  • Affected Location: src/middleware/corsProxy.js:31
  • Trigger Scenario: SSRF in optional CORS proxy

Root Cause

corsProxyMiddleware forwards req.params.url directly into fetch(url, ...). It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF.

Source-to-Sink Chain

  1. Source (user-controlled input)

  2. Entry point: GET /proxy/:url(*)

  3. Data flow

  4. Code analysis shows concrete propagation into this sink:
  5. vulnerability title: SSRF in optional CORS proxy
  6. sink location reached by attacker-controlled input: src/middleware/corsProxy.js:31

  7. The same sink behavior is confirmed by controlled execution observations.

  8. Sink (dangerous operation)

  9. Sink location: src/middleware/corsProxy.js:31
  10. Vulnerable behavior: SSRF in optional CORS proxy

Exploitation Preconditions

  1. The attacker can control or influence a URL/endpoint parameter.
  2. The server can access internal or sensitive network targets.
  3. Outbound request validation or redirect controls are insufficient.

Risk

This issue can be used to pivot network access and reach unintended internal resources.

Impact

An attacker may access internal network services or metadata endpoints and exfiltrate sensitive responses.

Remediation

  1. Enforce strict destination allowlist for proxy targets.
  2. Block loopback, link-local, RFC1918, and metadata address ranges.
  3. Apply the same destination validation to redirects.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.17.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "sillytavern"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44652"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-12T22:24:05Z",
    "nvd_published_at": "2026-05-29T19:16:25Z",
    "severity": "MODERATE"
  },
  "details": "## Resolution\n\nSillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.\n\nDocumentation: \n\n- https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelisting\n- https://docs.sillytavern.app/administration/#security-checklist\n\n## Note on future SSRF findings\n\nSince the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.\n\n## Overview\n- Vulnerability Type: SSRF\n- Affected Location: `src/middleware/corsProxy.js:31`\n- Trigger Scenario: SSRF in optional CORS proxy\n\n## Root Cause\n`corsProxyMiddleware` forwards `req.params.url` directly into `fetch(url, ...)`. It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF.\n\n## Source-to-Sink Chain\n1. Source (user-controlled input)\n- Entry point: `GET /proxy/:url(*)`\n\n2. Data flow\n- Code analysis shows concrete propagation into this sink:\n  - vulnerability title: `SSRF in optional CORS proxy`\n  - sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:31`\n- The same sink behavior is confirmed by controlled execution observations.\n\n3. Sink (dangerous operation)\n- Sink location: `src/middleware/corsProxy.js:31`\n- Vulnerable behavior: SSRF in optional CORS proxy\n\n## Exploitation Preconditions\n1. The attacker can control or influence a URL/endpoint parameter.\n2. The server can access internal or sensitive network targets.\n3. Outbound request validation or redirect controls are insufficient.\n\n## Risk\nThis issue can be used to pivot network access and reach unintended internal resources.\n\n## Impact\nAn attacker may access internal network services or metadata endpoints and exfiltrate sensitive responses.\n\n## Remediation\n1. Enforce strict destination allowlist for proxy targets.\n2. Block loopback, link-local, RFC1918, and metadata address ranges.\n3. Apply the same destination validation to redirects.",
  "id": "GHSA-ccfq-2454-f5xw",
  "modified": "2026-06-09T10:32:18Z",
  "published": "2026-05-12T22:24:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-ccfq-2454-f5xw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44652"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SillyTavern/SillyTavern"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SillyTavern has a SSRF vulnerability in the CORS proxy middleware"
}

GHSA-CCJ4-QHW4-4RRM

Vulnerability from github – Published: 2024-10-10 12:31 – Updated: 2024-10-10 12:31
VLAI
Details

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-8977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-10T10:15:08Z",
    "severity": "HIGH"
  },
  "details": "An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.",
  "id": "GHSA-ccj4-qhw4-4rrm",
  "modified": "2024-10-10T12:31:13Z",
  "published": "2024-10-10T12:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8977"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2697456"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/491060"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CF4R-PXWW-5Q94

Vulnerability from github – Published: 2024-12-18 18:30 – Updated: 2024-12-18 21:30
VLAI
Details

In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-55086"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-18T17:15:14Z",
    "severity": "HIGH"
  },
  "details": "In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.",
  "id": "GHSA-cf4r-pxww-5q94",
  "modified": "2024-12-18T21:30:55Z",
  "published": "2024-12-18T18:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55086"
    },
    {
      "type": "WEB",
      "url": "https://getsimple-ce.ovh"
    },
    {
      "type": "WEB",
      "url": "https://tasteful-stamp-da4.notion.site/CVE-2024-55086-15b1e0f227cb80e4bf4ed76aac53f795"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CFC8-RW2H-JFG7

Vulnerability from github – Published: 2026-04-11 03:30 – Updated: 2026-04-11 03:30
VLAI
Details

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-11T02:16:02Z",
    "severity": "MODERATE"
  },
  "details": "The UsersWP \u2013 Front-end login form, User Registration, User Profile \u0026 Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services.",
  "id": "GHSA-cfc8-rw2h-jfg7",
  "modified": "2026-04-11T03:30:30Z",
  "published": "2026-04-11T03:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4979"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AyeCode/userswp/commit/ca0c81b9c76a26c5ac78a8f3604cf9122a7a4aa1"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/class-forms.php#L198"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/helpers/misc.php#L136"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L198"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/helpers/misc.php#L136"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd2b3fd-1bca-4611-9753-ccb57b0e36a4?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CFH4-7WQ9-6PGG

Vulnerability from github – Published: 2023-06-30 20:35 – Updated: 2023-11-17 22:31
VLAI
Summary
WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)
Details

Impact

Users with capabilities to upload media (editors and above) are succeptible to SSRF (Server-Side Request Forgery) when executing the createMediaItem Mutation.

Authenticated users making GraphQL requests that execute the createMediaItem could pass executable paths in the mutations filePath argument that could give them unwarranted access to the server.

It's recommended to update to WPGraphQL v1.14.6 or newer. If you're unable to do so, below is a snippet you can add to your functions.php (or similar) that filters the createMediaItem mutation's resolver.

Patches

  • v1.14.6
  • https://github.com/wp-graphql/wp-graphql/pull/2840

Workarounds

If you're unable to upgrade to v1.14.6 or higher, you should be able to use the following snippet in your functions.php to override the vulnerable resolver.

This snippet has been tested as far back as WPGraphQL v0.15

add_filter( 'graphql_pre_resolve_field', function( $nil, $source, $args, $context, \GraphQL\Type\Definition\ResolveInfo $info, $type_name, $field_key, $field, $field_resolver ) {

    if ( $info->fieldName !== 'createMediaItem' ) {
        return $nil;
    }

    $input = $args['input'] ?? null;

        if ( ! isset( $input['filePath'] ) ) {
        return $nil;
    }

    $uploaded_file_url   = $input['filePath'];

    // Check that the filetype is allowed
    $check_file = wp_check_filetype( $uploaded_file_url );

    // if the file doesn't pass the check, throw an error
    if ( ! $check_file['ext'] || ! $check_file['type'] || ! wp_http_validate_url( $uploaded_file_url ) ) {
        throw new \GraphQL\Error\UserError( sprintf( __( 'Invalid filePath "%s"', 'wp-graphql' ), $input['filePath'] ) );
    }

    $protocol = wp_parse_url( $input['filePath'], PHP_URL_SCHEME );

    // prevent the filePath from being submitted with a non-allowed protocols
    $allowed_protocols = [ 'https', 'http', 'file' ];

    if ( ! in_array( $protocol, $allowed_protocols, true ) ) {
        throw new \GraphQL\Error\UserError( sprintf( __( 'Invalid protocol. "%1$s". Only "%2$s" allowed.', 'wp-graphql' ), $protocol, implode( '", "', $allowed_protocols ) ) );
    }

    return $nil;

}, 10, 9 );

References

  • https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.14.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "wp-graphql/wp-graphql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-23684"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-30T20:35:37Z",
    "nvd_published_at": "2023-11-13T03:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nUsers with capabilities to upload media (editors and above) are succeptible to SSRF (Server-Side Request Forgery) when executing the `createMediaItem` Mutation. \n\nAuthenticated users making GraphQL requests that execute the `createMediaItem` could pass executable paths in the mutations `filePath` argument that could give them unwarranted access to the server. \n\nIt\u0027s recommended to update to WPGraphQL v1.14.6 or newer. If you\u0027re unable to do so, below is a snippet you can add to your functions.php (or similar) that filters the `createMediaItem` mutation\u0027s resolver. \n\n### Patches\n\n- [v1.14.6](https://github.com/wp-graphql/wp-graphql/releases/tag/v1.14.6)\n- https://github.com/wp-graphql/wp-graphql/pull/2840\n\n### Workarounds\nIf you\u0027re unable to upgrade to v1.14.6 or higher, you should be able to use the following snippet in your functions.php to override the vulnerable resolver. \n\nThis snippet has been tested as far back as WPGraphQL v0.15\n\n```php\nadd_filter( \u0027graphql_pre_resolve_field\u0027, function( $nil, $source, $args, $context, \\GraphQL\\Type\\Definition\\ResolveInfo $info, $type_name, $field_key, $field, $field_resolver ) {\n\n\tif ( $info-\u003efieldName !== \u0027createMediaItem\u0027 ) {\n\t\treturn $nil;\n\t}\n\n\t$input = $args[\u0027input\u0027] ?? null;\n\n        if ( ! isset( $input[\u0027filePath\u0027] ) ) {\n\t\treturn $nil;\n\t}\n\n\t$uploaded_file_url   = $input[\u0027filePath\u0027];\n\n\t// Check that the filetype is allowed\n\t$check_file = wp_check_filetype( $uploaded_file_url );\n\n\t// if the file doesn\u0027t pass the check, throw an error\n\tif ( ! $check_file[\u0027ext\u0027] || ! $check_file[\u0027type\u0027] || ! wp_http_validate_url( $uploaded_file_url ) ) {\n\t\tthrow new \\GraphQL\\Error\\UserError( sprintf( __( \u0027Invalid filePath \"%s\"\u0027, \u0027wp-graphql\u0027 ), $input[\u0027filePath\u0027] ) );\n\t}\n\n\t$protocol = wp_parse_url( $input[\u0027filePath\u0027], PHP_URL_SCHEME );\n\n\t// prevent the filePath from being submitted with a non-allowed protocols\n\t$allowed_protocols = [ \u0027https\u0027, \u0027http\u0027, \u0027file\u0027 ];\n\n\tif ( ! in_array( $protocol, $allowed_protocols, true ) ) {\n\t\tthrow new \\GraphQL\\Error\\UserError( sprintf( __( \u0027Invalid protocol. \"%1$s\". Only \"%2$s\" allowed.\u0027, \u0027wp-graphql\u0027 ), $protocol, implode( \u0027\", \"\u0027, $allowed_protocols ) ) );\n\t}\n\n\treturn $nil;\n\n}, 10, 9 );\n```\n\n### References\n\n- https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability\n",
  "id": "GHSA-cfh4-7wq9-6pgg",
  "modified": "2023-11-17T22:31:01Z",
  "published": "2023-06-30T20:35:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-cfh4-7wq9-6pgg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23684"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wp-graphql/wp-graphql/pull/2840"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wp-graphql/wp-graphql"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v1.14.6"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)"
}

GHSA-CG2X-QC59-J254

Vulnerability from github – Published: 2022-06-14 00:00 – Updated: 2022-06-28 00:00
VLAI
Details

A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-40604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-13T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.",
  "id": "GHSA-cg2x-qc59-j254",
  "modified": "2022-06-28T00:00:55Z",
  "published": "2022-06-14T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40604"
    },
    {
      "type": "WEB",
      "url": "https://invisioncommunity.com/release-notes/462-r99"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CG7H-PHWJ-Q3QC

Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-20 15:31
VLAI
Details

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-26338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-19T18:24:59Z",
    "severity": "MODERATE"
  },
  "details": "Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.",
  "id": "GHSA-cg7h-phwj-q3qc",
  "modified": "2026-02-20T15:31:00Z",
  "published": "2026-02-19T18:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26338"
    },
    {
      "type": "WEB",
      "url": "https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551"
    },
    {
      "type": "WEB",
      "url": "https://www.hyland.com/en/solutions/products/alfresco-platform"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-ssrf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-CG7W-RG45-PC59

Vulnerability from github – Published: 2026-06-26 19:17 – Updated: 2026-06-26 19:17
VLAI
Summary
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Details

Summary

When an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that routes the affected IPv6 transition forms (NAT64- or ISATAP-configured networks), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix did not decode — IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, or ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint, exposing cloud IAM short-term credentials.

The bypass is exploitable only in environments whose network actually routes these forms — NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route them and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth.

This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). The prior remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix; the metadata guarantee did not hold for the remaining transition forms.

Severity

MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N = 6.8

Same impact metrics and narrow attack surface as the parent advisory (AC:H): exploitation requires the application to have opted into allow-local on a URL influenced by untrusted input, and the NAT64/ISATAP variants additionally require the deployment network to route those forms.

CWE-918: Server-Side Request Forgery (SSRF)

Affected Versions

Package Vulnerable Patched
pydantic-ai >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3 1.102.0; 2.0.0b3
pydantic-ai-slim >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3 1.102.0; 2.0.0b3

These transition forms have not been decoded since SSRF protection was introduced in 1.56.0.

Who Is Affected

Users are affected only if their application explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL that is, or could be, influenced by untrusted input.

Beyond that precondition, the affected encodings only reach a metadata endpoint in environments whose network actually routes them. The broadly-routable IPv4-mapped form was addressed in 1.99.0 (CVE-2026-46678); the additional forms addressed here require a NAT64-configured network (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or an ISATAP tunnel for the ISATAP variant. The IPv4-compatible and Teredo forms are deprecated and not routed by modern stacks; they are addressed as defense-in-depth. Most deployments on a standard dual-stack cloud VM or container are therefore not exploitable in practice, but the fix restores the "always blocked" guarantee for the environments that are.

Users are not affected if they use any of the bundled integrations to ingest user input, because they do not propagate force_download from external data:

  • Agent.to_web / clai web
  • VercelAIAdapter
  • AGUIAdapter / Agent.to_ag_ui

Applications that only download from developer-controlled URLs are not affected.

Remediation

Upgrade to 1.102.0 or later (or 2.0.0b3 or later on the 2.0 pre-release line). The cloud-metadata and private-IP blocklists now decode the embedded IPv4 of every standardized IPv6 transition form before evaluating it — IPv4-mapped, IPv4-compatible, 6to4, NAT64 across all prefix lengths (including the RFC 8215 local-use prefix and operator-chosen prefixes), ISATAP, and Teredo. The set of always-blocked cloud metadata/credential endpoints has also been expanded across providers.

Workaround for Unpatched Versions

Avoid passing force_download='allow-local' on any URL that could be influenced by untrusted input. If developers must, resolve the hostname themselves and validate the result against their own metadata blocklist — including IPv6 transition forms — before constructing the FileUrl.

Credits

Reported by @SnailSploit.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.56.0"
            },
            {
              "fixed": "1.102.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.56.0"
            },
            {
              "fixed": "1.102.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0b1"
            },
            {
              "fixed": "2.0.0b3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0b1"
            },
            {
              "fixed": "2.0.0b3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T19:17:56Z",
    "nvd_published_at": "2026-06-17T13:20:43Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen an application using Pydantic AI opts a URL into `force_download=\u0027allow-local\u0027` (which disables the default block on private/internal IPs) **and runs on a network that routes the affected IPv6 transition forms (NAT64- or ISATAP-configured networks)**, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix did not decode \u2014 IPv4-compatible IPv6 (`::a.b.c.d`), the NAT64 RFC 8215 local-use prefix (`64:ff9b:1::/48`), operator-chosen NAT64 prefixes, or ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint, exposing cloud IAM short-term credentials.\n\n**The bypass is exploitable only in environments whose network actually routes these forms** \u2014 NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route them and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth.\n\nThis is an incomplete fix of [GHSA-cqp8-fcvh-x7r3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3) / [CVE-2026-46678](https://nvd.nist.gov/vuln/detail/CVE-2026-46678) (itself a follow-up to [CVE-2026-25580](https://nvd.nist.gov/vuln/detail/CVE-2026-25580)). The prior remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix; the metadata guarantee did not hold for the remaining transition forms.\n\n## Severity\n\n**MEDIUM** \u2014 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N` = **6.8**\n\nSame impact metrics and narrow attack surface as the parent advisory (AC:H): exploitation requires the application to have opted into `allow-local` on a URL influenced by untrusted input, and the NAT64/ISATAP variants additionally require the deployment network to route those forms.\n\n**CWE-918**: Server-Side Request Forgery (SSRF)\n\n## Affected Versions\n\n| Package | Vulnerable | Patched |\n|---|---|---|\n| `pydantic-ai` | `\u003e= 1.56.0, \u003c 1.102.0`; `\u003e= 2.0.0b1, \u003c 2.0.0b3` | `1.102.0`; `2.0.0b3` |\n| `pydantic-ai-slim` | `\u003e= 1.56.0, \u003c 1.102.0`; `\u003e= 2.0.0b1, \u003c 2.0.0b3` | `1.102.0`; `2.0.0b3` |\n\nThese transition forms have not been decoded since SSRF protection was introduced in `1.56.0`.\n\n## Who Is Affected\n\nUsers are affected **only if** their application explicitly opts a `FileUrl` (`ImageUrl`, `AudioUrl`, `VideoUrl`, `DocumentUrl`) into `force_download=\u0027allow-local\u0027` on a URL that is, or could be, influenced by untrusted input.\n\nBeyond that precondition, the affected encodings only reach a metadata endpoint in environments whose network actually routes them. The broadly-routable IPv4-mapped form was addressed in `1.99.0` (CVE-2026-46678); the additional forms addressed here require a **NAT64-configured network** (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or an **ISATAP tunnel** for the ISATAP variant. The IPv4-compatible and Teredo forms are deprecated and not routed by modern stacks; they are addressed as defense-in-depth. Most deployments on a standard dual-stack cloud VM or container are therefore not exploitable in practice, but the fix restores the \"always blocked\" guarantee for the environments that are.\n\nUsers are **not** affected if they use any of the bundled integrations to ingest user input, because they do not propagate `force_download` from external data:\n\n- `Agent.to_web` / `clai web`\n- `VercelAIAdapter`\n- `AGUIAdapter` / `Agent.to_ag_ui`\n\nApplications that only download from developer-controlled URLs are not affected.\n\n## Remediation\n\nUpgrade to `1.102.0` or later (or `2.0.0b3` or later on the 2.0 pre-release line). The cloud-metadata and private-IP blocklists now decode the embedded IPv4 of every standardized IPv6 transition form before evaluating it \u2014 IPv4-mapped, IPv4-compatible, 6to4, NAT64 across all prefix lengths (including the RFC 8215 local-use prefix and operator-chosen prefixes), ISATAP, and Teredo. The set of always-blocked cloud metadata/credential endpoints has also been expanded across providers.\n\n## Workaround for Unpatched Versions\n\nAvoid passing `force_download=\u0027allow-local\u0027` on any URL that could be influenced by untrusted input. If developers must, resolve the hostname themselves and validate the result against their own metadata blocklist \u2014 including IPv6 transition forms \u2014 before constructing the `FileUrl`.\n\n## Credits\n\nReported by [@SnailSploit](https://snailsploit.com).",
  "id": "GHSA-cg7w-rg45-pc59",
  "modified": "2026-06-26T19:17:56Z",
  "published": "2026-06-26T19:17:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/pull/5596"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydantic/pydantic-ai"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)"
}

GHSA-CG8W-GW69-JWCJ

Vulnerability from github – Published: 2023-02-02 00:30 – Updated: 2023-02-08 21:30
VLAI
Details

maccms10 2021.1000.2000 is vulnerable to Server-side request forgery (SSRF).

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-47872"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-01T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "maccms10 2021.1000.2000 is vulnerable to Server-side request forgery (SSRF).",
  "id": "GHSA-cg8w-gw69-jwcj",
  "modified": "2023-02-08T21:30:18Z",
  "published": "2023-02-02T00:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47872"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cedric1314/CVE-2022-47872/blob/main/README.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CGC3-WXQQ-7X44

Vulnerability from github – Published: 2024-06-03 12:30 – Updated: 2026-04-01 18:31
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.42.

Severity
4.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-35633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-03T10:15:13Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.42.",
  "id": "GHSA-cgc3-wxqq-7x44",
  "modified": "2026-04-01T18:31:47Z",
  "published": "2024-06-03T12:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35633"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-0-42-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/blocksy-companion/wordpress-blocksy-companion-plugin-2-0-42-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list