{"vulnerability": "CVE-2026-112299", "sightings": [{"uuid": "8373eb52-8526-41f0-b626-a11d4c16318e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-112299", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117469475319790723", "content": "CVE-2026-112299 smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112299https://vuldb.com/vuln/422345https://vuldb.com/vuln/422345/ctihttps://vuldb.com/cve/CVE-2026-112299https://vuldb.com/submit/986838https://github.com/smrealms/smr/pull/2579https://github.com/smrealms/smr/commit/cb402e7f4e70b617b59d8c55dbe926b951ceb4a8https://github.com/smrealms/smr/#smrealms #smr#CVE_2026_112299#bot", "creation_timestamp": "2026-10-19T20:32:25.814782Z"}]}