CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6723 vulnerabilities reference this CWE, most recent first.
GHSA-7WHX-V52V-GG25
Vulnerability from github – Published: 2025-01-05 12:30 – Updated: 2025-01-05 12:30A vulnerability was found in wangl1989 mysiteforme 1.0. It has been rated as critical. This issue affects the function doContent of the file src/main/java/com/mysiteform/admin/controller/system/FileController. The manipulation of the argument content leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2024-13139"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-05T11:15:07Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in wangl1989 mysiteforme 1.0. It has been rated as critical. This issue affects the function doContent of the file src/main/java/com/mysiteform/admin/controller/system/FileController. The manipulation of the argument content leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-7whx-v52v-gg25",
"modified": "2025-01-05T12:30:30Z",
"published": "2025-01-05T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13139"
},
{
"type": "WEB",
"url": "https://github.com/wangl1989/mysiteforme/issues/56"
},
{
"type": "WEB",
"url": "https://github.com/wangl1989/mysiteforme/issues/56#issue-2757876365"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290213"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290213"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.468513"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7WM7-V445-MPW3
Vulnerability from github – Published: 2026-11-03 15:32 – Updated: 2026-11-03 15:32SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
{
"affected": [],
"aliases": [
"CVE-2026-121422"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-03T15:17:32Z",
"severity": "MODERATE"
},
"details": "SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.",
"id": "GHSA-7wm7-v445-mpw3",
"modified": "2026-11-03T15:32:13Z",
"published": "2026-11-03T15:32:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121422"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7WPF-CH8F-5F4X
Vulnerability from github – Published: 2026-10-30 22:57 – Updated: 2026-10-30 22:57Summary
The app store icon code (dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138) resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute http(s) URL is used as-is: the server fetches it, follows redirects, and stores any image/* response as the plugin's icon, which is then served to the admin UI. Unrelated to GHSA-q59x-jc9f-gfqf.
Affected
signalk-server 2.33.0 (latest).
Reproduction
The real dist modules driven directly, Docker with --network none; a local "internal" service on 127.0.0.1 logs requests:
[CONTROL relative] declared=../../icon.png
resolved=null
internal-service hits: [] stored: null
[ATTACK absolute] declared=http://127.0.0.1:35013/latest/meta-data/iam
resolved=http://127.0.0.1:35013/latest/meta-data/iam
internal-service hits: ["GET /latest/meta-data/iam"] stored: .../icon-bytes/evil-plugin@1.0.0.png (70 bytes)
[ATTACK redirect] declared=http://127.0.0.1:35013/redir
internal-service hits: ["GET /redir","GET /internal-secret-via-redirect.png"] stored: .../icon-bytes/evil-plugin@1.0.0.png (70 bytes)
The modules were tested directly rather than through a full running server.
Impact
Anyone who can get a plugin listed in the app store (publishing an npm package with the signalk keywords) can make every signalk-server that browses the app store send requests to internal addresses on the vessel network and to cloud metadata endpoints. Responses with an image content type are stored and served back to the user.
Suggested fix
Only accept relative icon paths resolved against the CDN (or an https allowlist of known hosts), do not follow redirects to other hosts, and reject private, loopback and link-local addresses after resolution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "signalk-server"
},
"ranges": [
{
"events": [
{
"introduced": "2.28.0-beta.2"
},
{
"fixed": "2.34.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-30T22:57:37Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe app store icon code (`dist/appstore/icon-probe.js` around line 200 and `icon-bytes.js` around line 138) resolves a plugin\u0027s declared `signalk.appIcon`. Relative paths are pinned to the CDN, but an absolute http(s) URL is used as-is: the server fetches it, follows redirects, and stores any `image/*` response as the plugin\u0027s icon, which is then served to the admin UI. Unrelated to GHSA-q59x-jc9f-gfqf.\n\n### Affected\n\nsignalk-server 2.33.0 (latest).\n\n### Reproduction\n\nThe real dist modules driven directly, Docker with `--network none`; a local \"internal\" service on 127.0.0.1 logs requests:\n\n```\n[CONTROL relative] declared=../../icon.png\n resolved=null\n internal-service hits: [] stored: null\n[ATTACK absolute] declared=http://127.0.0.1:35013/latest/meta-data/iam\n resolved=http://127.0.0.1:35013/latest/meta-data/iam\n internal-service hits: [\"GET /latest/meta-data/iam\"] stored: .../icon-bytes/evil-plugin@1.0.0.png (70 bytes)\n[ATTACK redirect] declared=http://127.0.0.1:35013/redir\n internal-service hits: [\"GET /redir\",\"GET /internal-secret-via-redirect.png\"] stored: .../icon-bytes/evil-plugin@1.0.0.png (70 bytes)\n```\n\nThe modules were tested directly rather than through a full running server.\n\n### Impact\n\nAnyone who can get a plugin listed in the app store (publishing an npm package with the signalk keywords) can make every signalk-server that browses the app store send requests to internal addresses on the vessel network and to cloud metadata endpoints. Responses with an image content type are stored and served back to the user.\n\n### Suggested fix\n\nOnly accept relative icon paths resolved against the CDN (or an https allowlist of known hosts), do not follow redirects to other hosts, and reject private, loopback and link-local addresses after resolution.",
"id": "GHSA-7wpf-ch8f-5f4x",
"modified": "2026-10-30T22:57:37Z",
"published": "2026-10-30T22:57:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7wpf-ch8f-5f4x"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/commit/535104f655304c697d535252da397948e5101dc6"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/commit/7eeae00ac4aee5f04e21e3ff9527f57823e65a4d"
},
{
"type": "PACKAGE",
"url": "https://github.com/SignalK/signalk-server"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.34.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/signal-k-server-2.28.0-beta.2-before-2.34.0-ssrf-via-app-store-appicon"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher"
}
GHSA-7WQC-W7WJ-5FM5
Vulnerability from github – Published: 2026-07-17 21:31 – Updated: 2026-07-17 21:31IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.
{
"affected": [],
"aliases": [
"CVE-2026-7754"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-17T20:17:29Z",
"severity": "HIGH"
},
"details": "IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.",
"id": "GHSA-7wqc-w7wj-5fm5",
"modified": "2026-07-17T21:31:45Z",
"published": "2026-07-17T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7754"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7278930"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7WWH-XCC3-9FCG
Vulnerability from github – Published: 2026-06-22 20:28 – Updated: 2026-06-22 20:28Summary
The PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations.
Technical details:
The /extensions/paypal/webhook endpoint processes incoming webhook requests and trusts the value of the PAYPAL-CERT-URL HTTP header without validation.
This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage.
As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations.
Impact
This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints.
Depending on network configuration, this may lead to:
- Blind SSRF to external attacker-controlled systems
- Potential access to internal network services
No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "paymenter/paymenter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44583"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-22T20:28:29Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe PayPal webhook endpoint `/extensions/paypal/webhook` processes the `PAYPAL-CERT-URL` HTTP header without validation, allowing attackers to control server-side HTTP request destinations.\n\n### Technical details:\n\nThe `/extensions/paypal/webhook` endpoint processes incoming webhook requests and trusts the value of the `PAYPAL-CERT-URL` HTTP header without validation.\n\nThis value is passed directly into a server-side HTTP request via `file_get_contents`, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage.\n\nAs a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations.\n\n### Impact\nThis vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints.\n\nDepending on network configuration, this may lead to:\n\n- Blind SSRF to external attacker-controlled systems\n- Potential access to internal network services\n\nNo direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels.",
"id": "GHSA-7wwh-xcc3-9fcg",
"modified": "2026-06-22T20:28:29Z",
"published": "2026-06-22T20:28:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg"
},
{
"type": "PACKAGE",
"url": "https://github.com/Paymenter/Paymenter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module"
}
GHSA-7XC7-3PRM-FPX6
Vulnerability from github – Published: 2025-03-25 12:30 – Updated: 2025-03-25 12:30The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-2109"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T11:15:36Z",
"severity": "MODERATE"
},
"details": "The WP Compress \u2013 Instant Performance \u0026 Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.",
"id": "GHSA-7xc7-3prm-fpx6",
"modified": "2025-03-25T12:30:30Z",
"published": "2025-03-25T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2109"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/wp-compress-core.php#L994"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3254259"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/wp-compress-image-optimizer/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10b9d703-de9d-472a-bdfb-bc9a41bf375e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7XFM-HCFV-34HC
Vulnerability from github – Published: 2022-05-17 02:50 – Updated: 2025-04-20 03:35MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
{
"affected": [],
"aliases": [
"CVE-2017-7566"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-06T16:59:00Z",
"severity": "HIGH"
},
"details": "MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.",
"id": "GHSA-7xfm-hcfv-34hc",
"modified": "2025-04-20T03:35:28Z",
"published": "2022-05-17T02:50:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7566"
},
{
"type": "WEB",
"url": "https://github.com/mybb/mybb/commit/f5de8fc2aad11e0d2583f585535ccfa2b46325db#diff-7fe6e55397c77ab9a0f5d57bc4cbe5b9R6781"
},
{
"type": "WEB",
"url": "https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release"
},
{
"type": "WEB",
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170407-0_MyBB_SSRF_vulnerability_v10.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97480"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7XG4-C58X-526W
Vulnerability from github – Published: 2024-04-30 18:30 – Updated: 2024-07-03 18:37OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info.
{
"affected": [],
"aliases": [
"CVE-2024-33832"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T18:15:20Z",
"severity": "MODERATE"
},
"details": "OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api\u0026method=get_link_info.",
"id": "GHSA-7xg4-c58x-526w",
"modified": "2024-07-03T18:37:47Z",
"published": "2024-04-30T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33832"
},
{
"type": "WEB",
"url": "https://github.com/helloxz/onenav/issues/186"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7XJ2-3647-RGJF
Vulnerability from github – Published: 2025-03-17 18:31 – Updated: 2025-03-17 18:31Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
{
"affected": [],
"aliases": [
"CVE-2025-22474"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-17T17:15:39Z",
"severity": "MODERATE"
},
"details": "Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.",
"id": "GHSA-7xj2-3647-rgjf",
"modified": "2025-03-17T18:31:52Z",
"published": "2025-03-17T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22474"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000289970/dsa-2025-070-security-update-for-dell-networking-os10-vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000293638/dsa-2025-069-security-update-for-dell-networking-os10-vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000294091/dsa-2025-079-security-update-for-dell-networking-os10-vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000295014/dsa-2025-068-security-update-for-dell-networking-os10-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7XJC-3PFC-P9WJ
Vulnerability from github – Published: 2026-07-28 21:31 – Updated: 2026-07-28 21:31The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the get_urls_from_html() function using DOMDocument::loadHTMLFile() to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site's server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and interact with internal services.
{
"affected": [],
"aliases": [
"CVE-2026-4912"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-28T19:17:36Z",
"severity": "MODERATE"
},
"details": "The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site\u0027s server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and interact with internal services.",
"id": "GHSA-7xjc-3pfc-p9wj",
"modified": "2026-07-28T21:31:32Z",
"published": "2026-07-28T21:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4912"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/core.php#L565"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/core.php#L570"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/rest.php#L118"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026n%20ew3492257%40media-cleaner%2Ftrunk\u0026old=3447443%40media-cleaner%2Ftrunk\u0026sfp_ema%20il=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c9214d-45d4-4477-8244-7802a4901114?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.