Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4710 vulnerabilities reference this CWE, most recent first.

GHSA-JCW2-6V8C-W2H9

Vulnerability from github – Published: 2024-05-14 15:32 – Updated: 2026-04-08 21:32
VLAI
Details

The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T14:47:31Z",
    "severity": "MODERATE"
  },
  "details": "The Starter Templates \u2014 Elementor, WordPress \u0026 Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-jcw2-6v8c-w2h9",
  "modified": "2026-04-08T21:32:35Z",
  "published": "2024-05-14T15:32:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1467"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites-importer.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5075f9-9658-4a09-bd38-34a72f6560f4?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JF2M-JHCF-5XQG

Vulnerability from github – Published: 2021-12-23 00:01 – Updated: 2024-03-21 03:34
VLAI
Details

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF)

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-44659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-22T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF)",
  "id": "GHSA-jf2m-jhcf-5xqg",
  "modified": "2024-03-21T03:34:09Z",
  "published": "2021-12-23T00:01:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44659"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Mesh3l911/CVE-2021-44659"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gocd/gocd"
    },
    {
      "type": "WEB",
      "url": "https://www.gocd.org"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/WW_a3znugl0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JF3W-JJ77-822X

Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-22 21:33
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through < 5.7.2.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-24381"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-22T17:16:41Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through \u003c 5.7.2.",
  "id": "GHSA-jf3w-jj77-822x",
  "modified": "2026-01-22T21:33:46Z",
  "published": "2026-01-22T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24381"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/photome/vulnerability/wordpress-photome-theme-5-7-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JFFW-G7W7-WFVV

Vulnerability from github – Published: 2022-10-14 12:00 – Updated: 2022-10-14 19:00
VLAI
Details

ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-41497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-13T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php.",
  "id": "GHSA-jffw-g7w7-wfvv",
  "modified": "2022-10-14T19:00:40Z",
  "published": "2022-10-14T12:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41497"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jayus0821/insight/blob/master/ClipperCMS%20SSRF.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JFGF-83C5-2C4M

Vulnerability from github – Published: 2026-04-29 22:26 – Updated: 2026-05-13 13:30
VLAI
Summary
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
Details

Summary

Versions of i18next-http-middleware prior to 3.9.3 pass the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitisation. Depending on which backend is configured, the unvalidated path segments enable one of two attacks:

  • Filesystem path traversal when the middleware is paired with i18next-fs-backend (or any backend that interpolates lng / ns into a filesystem path).
  • Server-Side Request Forgery (SSRF) when the middleware is paired with i18next-http-backend (or any backend that interpolates into an HTTP URL).

Example request:

GET /locales/resources.json?lng=../../etc/passwd&ns=root

with i18next-fs-backend reads the attacker-chosen file from disk; with i18next-http-backend reshapes the outgoing URL to target an internal service.

Impact

  • Arbitrary file read via fs-style backends — any file the Node process can read becomes reachable (source, configuration, .ssh keys, .env, Docker secrets, etc.).
  • SSRF via http-style backends — requests to internal IPs / hostnames not normally reachable from the internet; combined with cloud metadata endpoints this can escalate to credential theft.
  • Unbounded growth of i18next.options.ns — a now-incidental amplification: the pre-patch getResourcesHandler pushed every unique ns value into the shared i18next.options.ns singleton array without validation or bounds, enabling memory exhaustion from repeated unique payloads.

The severity is bounded by the backend in place, but the middleware itself exposed the unsanitised path; this is the "weakest link" layer.

Affected versions

< 3.9.3.

Patch

Fixed in 3.9.3. The patch introduces utils.isSafeIdentifier and applies it in getResourcesHandler before lng and ns reach the backend connector:

languages  = languages.filter(utils.isSafeIdentifier)
namespaces = namespaces.filter(utils.isSafeIdentifier)

isSafeIdentifier uses a denylist approach — it still accepts any legitimate i18next language-code shape (i18next FAQ) — rejecting:

  • .. sequences (relative path traversal)
  • path separators (/, \)
  • control characters (C0/C1)
  • prototype keys (__proto__ / constructor / prototype)
  • empty strings and values longer than 128 characters

Unsafe values are dropped; only safe values reach the backend. The fix is a defence-in-depth layer on top of any sanitisation the backend itself may apply.

Workarounds

No workaround short of upgrading. Front-proxying the middleware with a WAF rule that rejects requests containing .., /, \, or URL-structure characters in lng / ns is a partial mitigation. Upgrading the configured backend (i18next-fs-backend ≥ 2.6.4, i18next-http-backend ≥ 3.0.5) also closes the same attack at the next layer.

Related advisories fixed in the same release

  • GHSA-5fgg-jcpf-8jjw — prototype pollution via setPath and missingKeyHandler. Independently fixable, filed separately per CNA rules.
  • GHSA-c3h8-g69v-pjrg — HTTP response splitting + XSS-filter bypass (CVE-2026-41683).

Credits

Discovered via an internal security audit of the i18next ecosystem.

Resources

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "i18next-http-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-29T22:26:36Z",
    "nvd_published_at": "2026-05-08T16:16:12Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nVersions of `i18next-http-middleware` prior to 3.9.3 pass the user-controlled `lng` and `ns` values from `getResourcesHandler` directly into `i18next.services.backendConnector.load(languages, namespaces, \u2026)` without any sanitisation. Depending on which backend is configured, the unvalidated path segments enable one of two attacks:\n\n- **Filesystem path traversal** when the middleware is paired with `i18next-fs-backend` (or any backend that interpolates `lng` / `ns` into a filesystem path).\n- **Server-Side Request Forgery (SSRF)** when the middleware is paired with `i18next-http-backend` (or any backend that interpolates into an HTTP URL).\n\nExample request:\n\n```\nGET /locales/resources.json?lng=../../etc/passwd\u0026ns=root\n```\n\nwith `i18next-fs-backend` reads the attacker-chosen file from disk; with `i18next-http-backend` reshapes the outgoing URL to target an internal service.\n\n### Impact\n\n- **Arbitrary file read** via `fs`-style backends \u2014 any file the Node process can read becomes reachable (source, configuration, `.ssh` keys, `.env`, Docker secrets, etc.).\n- **SSRF** via `http`-style backends \u2014 requests to internal IPs / hostnames not normally reachable from the internet; combined with cloud metadata endpoints this can escalate to credential theft.\n- **Unbounded growth of `i18next.options.ns`** \u2014 a now-incidental amplification: the pre-patch `getResourcesHandler` pushed every unique `ns` value into the shared `i18next.options.ns` singleton array without validation or bounds, enabling memory exhaustion from repeated unique payloads.\n\nThe severity is bounded by the backend in place, but the middleware itself exposed the unsanitised path; this is the \"weakest link\" layer.\n\n### Affected versions\n\n`\u003c 3.9.3`.\n\n### Patch\n\nFixed in **3.9.3**. The patch introduces `utils.isSafeIdentifier` and applies it in `getResourcesHandler` before `lng` and `ns` reach the backend connector:\n\n```js\nlanguages  = languages.filter(utils.isSafeIdentifier)\nnamespaces = namespaces.filter(utils.isSafeIdentifier)\n```\n\n`isSafeIdentifier` uses a denylist approach \u2014 it still accepts any legitimate i18next language-code shape ([i18next FAQ](https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)) \u2014 rejecting:\n\n- `..` sequences (relative path traversal)\n- path separators (`/`, `\\`)\n- control characters (C0/C1)\n- prototype keys (`__proto__` / `constructor` / `prototype`)\n- empty strings and values longer than 128 characters\n\nUnsafe values are dropped; only safe values reach the backend. The fix is a defence-in-depth layer on top of any sanitisation the backend itself may apply.\n\n### Workarounds\n\nNo workaround short of upgrading. Front-proxying the middleware with a WAF rule that rejects requests containing `..`, `/`, `\\`, or URL-structure characters in `lng` / `ns` is a partial mitigation. Upgrading the configured backend (`i18next-fs-backend` \u2265 2.6.4, `i18next-http-backend` \u2265 3.0.5) also closes the same attack at the next layer.\n\n### Related advisories fixed in the same release\n\n- [GHSA-5fgg-jcpf-8jjw](https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw) \u2014 prototype pollution via `setPath` and `missingKeyHandler`. Independently fixable, filed separately per CNA rules.\n- [GHSA-c3h8-g69v-pjrg](https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg) \u2014 HTTP response splitting + XSS-filter bypass (CVE-2026-41683).\n\n### Credits\n\nDiscovered via an internal security audit of the i18next ecosystem.\n\n### Resources\n\n- [CWE-22: Path Traversal](https://cwe.mitre.org/data/definitions/22.html)\n- [CWE-918: Server-Side Request Forgery (SSRF)](https://cwe.mitre.org/data/definitions/918.html) (specific sub-case when paired with an HTTP backend)\n- [i18next FAQ: language code formatting](https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)",
  "id": "GHSA-jfgf-83c5-2c4m",
  "modified": "2026-05-13T13:30:17Z",
  "published": "2026-04-29T22:26:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42353"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/i18next/i18next-http-middleware"
    },
    {
      "type": "WEB",
      "url": "https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters"
}

GHSA-JFGP-Q2HG-W285

Vulnerability from github – Published: 2022-05-24 17:18 – Updated: 2023-08-21 18:37
VLAI
Summary
WSO2 API Manager vulnerable to SSRF
Details

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.wso2.am:am-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-13226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-13T00:30:32Z",
    "nvd_published_at": "2020-05-20T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node\u0027s entire intranet.",
  "id": "GHSA-jfgp-q2hg-w285",
  "modified": "2023-08-21T18:37:50Z",
  "published": "2022-05-24T17:18:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13226"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wso2/docs-apim/issues/816"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wso2/product-apim/issues/7677"
    },
    {
      "type": "WEB",
      "url": "https://docs.wso2.com/display/Security/Security+Advisories"
    },
    {
      "type": "WEB",
      "url": "https://docs.wso2.com/display/Security/WSO2+Security+Vulnerability+Management+Process"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wso2/product-apim"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WSO2 API Manager vulnerable to SSRF"
}

GHSA-JFJ5-MXVH-9VGR

Vulnerability from github – Published: 2026-01-08 00:31 – Updated: 2026-01-08 00:31
VLAI
Details

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-25290"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-08T00:15:58Z",
    "severity": "MODERATE"
  },
  "details": "Smartliving SmartLAN/G/SI \u003c=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the \u0027host\u0027 parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.",
  "id": "GHSA-jfj5-mxvh-9vgr",
  "modified": "2026-01-08T00:31:15Z",
  "published": "2026-01-08T00:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25290"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/172839"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/155617"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/47764"
    },
    {
      "type": "WEB",
      "url": "https://www.inim.biz"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-JFJW-XC26-6XPM

Vulnerability from github – Published: 2022-12-04 21:30 – Updated: 2025-04-24 18:31
VLAI
Details

Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-35508"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-04T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.",
  "id": "GHSA-jfjw-xc26-6xpm",
  "modified": "2025-04-24T18:31:01Z",
  "published": "2022-12-04T21:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35508"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=580d540ea907ba15f64379c5bb69ecf1a49a875f"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=c2bd69c7b5e9c775f96021cf8ae53da3dbd9029d"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=e9df8a6e76b2a18f89295a5d92a62177bbf0f762"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-http-server.git;a=commitdiff;h=580d540ea907ba15f64379c5bb69ecf1a49a875f"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-http-server.git;a=commitdiff;h=c2bd69c7b5e9c775f96021cf8ae53da3dbd9029d"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-http-server.git;a=commitdiff;h=e9df8a6e76b2a18f89295a5d92a62177bbf0f762"
    },
    {
      "type": "WEB",
      "url": "https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JFM3-JH2M-2H53

Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2026-04-01 18:33
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Kiboko Labs Chained Quiz allows Server Side Request Forgery. This issue affects Chained Quiz: from n/a through 1.3.2.9.

Severity
4.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-24701"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-24T18:15:43Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Kiboko Labs Chained Quiz allows Server Side Request Forgery. This issue affects Chained Quiz: from n/a through 1.3.2.9.",
  "id": "GHSA-jfm3-jh2m-2h53",
  "modified": "2026-04-01T18:33:27Z",
  "published": "2025-01-24T18:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24701"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/chained-quiz/vulnerability/wordpress-chained-quiz-plugin-1-3-2-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JFQV-GFXR-5HM7

Vulnerability from github – Published: 2026-07-10 00:31 – Updated: 2026-07-10 00:31
VLAI
Details

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-15317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T00:16:33Z",
    "severity": "LOW"
  },
  "details": "A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.",
  "id": "GHSA-jfqv-gfxr-5hm7",
  "modified": "2026-07-10T00:31:28Z",
  "published": "2026-07-10T00:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sipeed/picoclaw/issues/3078"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sipeed/picoclaw"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-15317"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/852877"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377257"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377257/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list