CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6678 vulnerabilities reference this CWE, most recent first.
GHSA-8VQH-RJH4-52QH
Vulnerability from github – Published: 2026-08-24 18:31 – Updated: 2026-08-25 09:30A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.
{
"affected": [],
"aliases": [
"CVE-2026-71366"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T16:17:22Z",
"severity": "HIGH"
},
"details": "A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.",
"id": "GHSA-8vqh-rjh4-52qh",
"modified": "2026-08-25T09:30:36Z",
"published": "2026-08-24T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71366"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59135"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59136"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59153"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59155"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-71366"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511902"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8VVF-7V96-575P
Vulnerability from github – Published: 2026-09-13 00:31 – Updated: 2026-09-13 00:31A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 86f370c9c20074c3c3fdec53a359874b8e670fd4. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.
{
"affected": [],
"aliases": [
"CVE-2026-90486"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-12T23:17:01Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 86f370c9c20074c3c3fdec53a359874b8e670fd4. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.",
"id": "GHSA-8vvf-7v96-575p",
"modified": "2026-09-13T00:31:19Z",
"published": "2026-09-13T00:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90486"
},
{
"type": "WEB",
"url": "https://github.com/openstatusHQ/openstatus/pull/2551"
},
{
"type": "WEB",
"url": "https://github.com/openstatusHQ/openstatus/commit/86f370c9c20074c3c3fdec53a359874b8e670fd4"
},
{
"type": "WEB",
"url": "https://github.com/openstatusHQ/openstatus"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90486"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/888087"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403074"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403074/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8W4F-PQVP-553J
Vulnerability from github – Published: 2026-02-05 12:30 – Updated: 2026-02-05 12:30The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2026-1294"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-05T10:16:03Z",
"severity": "HIGH"
},
"details": "The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-8w4f-pqvp-553j",
"modified": "2026-02-05T12:30:25Z",
"published": "2026-02-05T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1294"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/image-viewer/tags/1.0.2/image-viewer-block.php#L10"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3449642/image-viewer/tags/1.0.3/image-viewer-block.php?old=3405983\u0026old_path=image-viewer%2Ftags%2F1.0.2%2Fimage-viewer-block.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3f7108-eb32-425a-a705-4f032e7da6b0?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W5J-Q5MJ-5JPV
Vulnerability from github – Published: 2025-04-23 18:30 – Updated: 2025-04-23 18:30PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.
The specific flaw exists within the processing of the slack_incoming_webhook parameter. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25352.
{
"affected": [],
"aliases": [
"CVE-2025-1521"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-23T17:16:52Z",
"severity": "HIGH"
},
"details": "PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the processing of the slack_incoming_webhook parameter. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25352.",
"id": "GHSA-8w5j-q5mj-5jpv",
"modified": "2025-04-23T18:30:58Z",
"published": "2025-04-23T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1521"
},
{
"type": "WEB",
"url": "https://github.com/PostHog/posthog/commit/6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-096"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W7Q-Q5JP-JVGX
Vulnerability from github – Published: 2026-05-14 20:27 – Updated: 2026-05-15 23:55Summary
In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.
Details
In the current project, URL validation is performed using the function validate_url.
The current checking logic uses urlparse to parse the hostname part of the URL for verification.
However, there are actually differences in parsing between urlparse and the library that actually sends the request. For example, in files.py, validate_url is used first for URL validation, and then requests.get is used to send the request.
The core issue: urlparse() and requests disagree on which host a URL like http://127.0.0.1:6666\@1.1.1.1 points to:
urlparse()treats\as a regular character and@as the userinfo-host delimiter, so it extracts hostname as1.1.1.1(public)requeststreats\as a path character, connecting to127.0.0.1(internal)
Below is a test code I wrote following the open-webui code.
from __future__ import annotations
import ipaddress
import logging
import os
import socket
import urllib.parse
import urllib.request
from typing import Optional, Sequence, Union
import requests
log = logging.getLogger(__name__)
# Same text as open_webui.constants.ERROR_MESSAGES.INVALID_URL
INVALID_URL = (
"Oops! The URL you provided is invalid. Please double-check and try again."
)
# Same semantics as open_webui.config (ENABLE_RAG_LOCAL_WEB_FETCH / WEB_FETCH_FILTER_LIST)
ENABLE_RAG_LOCAL_WEB_FETCH = (
os.getenv("ENABLE_RAG_LOCAL_WEB_FETCH", "False").lower() == "true"
)
_DEFAULT_WEB_FETCH_FILTER_LIST = [
"!169.254.169.254",
"!fd00:ec2::254",
"!metadata.google.internal",
"!metadata.azure.com",
"!100.100.100.200",
]
_web_fetch_filter_env = os.getenv("WEB_FETCH_FILTER_LIST", "")
if _web_fetch_filter_env == "":
_web_fetch_filter_env_list: list[str] = []
else:
_web_fetch_filter_env_list = [
item.strip()
for item in _web_fetch_filter_env.split(",")
if item.strip()
]
WEB_FETCH_FILTER_LIST = list(
set(_DEFAULT_WEB_FETCH_FILTER_LIST + _web_fetch_filter_env_list)
)
def get_allow_block_lists(filter_list):
allow_list = []
block_list = []
if filter_list:
for d in filter_list:
if d.startswith("!"):
block_list.append(d[1:].strip())
else:
allow_list.append(d.strip())
return allow_list, block_list
def is_string_allowed(
string: Union[str, Sequence[str]], filter_list: Optional[list[str]] = None
) -> bool:
if not filter_list:
return True
allow_list, block_list = get_allow_block_lists(filter_list)
strings = [string] if isinstance(string, str) else list(string)
if allow_list:
if not any(s.endswith(allowed) for s in strings for allowed in allow_list):
return False
if any(s.endswith(blocked) for s in strings for blocked in block_list):
return False
return True
def resolve_hostname(hostname):
# Get address information
addr_info = socket.getaddrinfo(hostname, None)
# Extract IP addresses from address information
ipv4_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET]
ipv6_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET6]
return ipv4_addresses, ipv6_addresses
def _validators_url_accept(url: str) -> bool:
"""
Stand-in for python-validators url(): True if string looks like http(s) URL with host.
"""
try:
u = url.strip()
if not u:
return False
p = urllib.parse.urlparse(u)
if p.scheme not in ("http", "https"):
return False
if not p.netloc:
return False
return True
except Exception:
return False
def _ipv4_private(ip: str) -> bool:
try:
a = ipaddress.ip_address(ip)
return a.version == 4 and a.is_private
except ValueError:
return False
def _ipv6_private(ip: str) -> bool:
try:
a = ipaddress.ip_address(ip)
return a.version == 6 and a.is_private
except ValueError:
return False
def validate_url(url: Union[str, Sequence[str]]):
if isinstance(url, str):
if not _validators_url_accept(url):
raise ValueError(INVALID_URL)
parsed_url = urllib.parse.urlparse(url)
# Protocol validation - only allow http/https
if parsed_url.scheme not in ["http", "https"]:
log.warning(
f"Blocked non-HTTP(S) protocol: {parsed_url.scheme} in URL: {url}"
)
raise ValueError(INVALID_URL)
# Blocklist check using unified filtering logic
if WEB_FETCH_FILTER_LIST:
if not is_string_allowed(url, WEB_FETCH_FILTER_LIST):
log.warning(f"URL blocked by filter list: {url}")
raise ValueError(INVALID_URL)
if not ENABLE_RAG_LOCAL_WEB_FETCH:
# Local web fetch is disabled, filter out any URLs that resolve to private IP addresses
parsed_url = urllib.parse.urlparse(url)
# Get IPv4 and IPv6 addresses
ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname)
# Check if any of the resolved addresses are private
# This is technically still vulnerable to DNS rebinding attacks, as we don't control WebBaseLoader
for ip in ipv4_addresses:
if _ipv4_private(ip):
raise ValueError(INVALID_URL)
for ip in ipv6_addresses:
if _ipv6_private(ip):
raise ValueError(INVALID_URL)
return True
elif isinstance(url, Sequence):
return all(validate_url(u) for u in url)
else:
return False
if __name__ == "__main__":
logging.basicConfig(level=logging.INFO)
# url = "https://127.0.0.1:6666\@1.1.1.1"
url = "https://127.0.0.1:6666"
validate_url(url)
response = requests.get(url)
print(response.text)
As you can see, the current check on 127.0.0.1:6666 successfully identified it as an internal network IP and blocked it.
However, for https://127.0.0.1:6666\@1.1.1.1/, the hostname extracted by validate_url is 1.1.1.1, which is considered a public IP address and therefore passes validation. In reality, this URL is being used to request the internal IP address 127.0.0.1:6666, resulting in an SSRF bypass.
PoC
http://127.0.0.1:6666\@baidu.com
Impact
SSRF
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.4"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45400"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T20:27:00Z",
"nvd_published_at": "2026-05-15T21:16:38Z",
"severity": "HIGH"
},
"details": "### Summary\nIn the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.\n\n### Details\nIn the current project, URL validation is performed using the function validate_url.\n\n\u003cimg width=\"1323\" height=\"1145\" alt=\"QQ20260322-202854-22-1\" src=\"https://github.com/user-attachments/assets/896d19f2-c7c3-499a-9052-12aea756ac47\" /\u003e\n\nThe current checking logic uses urlparse to parse the hostname part of the URL for verification.\n\n\u003cimg width=\"1122\" height=\"429\" alt=\"QQ20260322-203014-22-2\" src=\"https://github.com/user-attachments/assets/653520e9-e311-4a5e-8345-a2446e217d88\" /\u003e\n\nHowever, there are actually differences in parsing between urlparse and the library that actually sends the request. For example, in files.py, validate_url is used first for URL validation, and then requests.get is used to send the request.\n\n\u003cimg width=\"1269\" height=\"915\" alt=\"QQ20260322-203122-22-3\" src=\"https://github.com/user-attachments/assets/f200aa06-9190-425e-9659-1ecaf95f806b\" /\u003e\n\nThe core issue: `urlparse()` and `requests` disagree on which host a URL like `http://127.0.0.1:6666\\@1.1.1.1` points to:\n\n- `urlparse()` treats `\\` as a regular character and `@` as the userinfo-host delimiter, so it extracts hostname as `1.1.1.1` (public)\n- `requests` treats `\\` as a path character, connecting to `127.0.0.1` (internal)\n\nBelow is a test code I wrote following the open-webui code.\n```\nfrom __future__ import annotations\n\nimport ipaddress\nimport logging\nimport os\nimport socket\nimport urllib.parse\nimport urllib.request\nfrom typing import Optional, Sequence, Union\nimport requests\n\nlog = logging.getLogger(__name__)\n\n# Same text as open_webui.constants.ERROR_MESSAGES.INVALID_URL\nINVALID_URL = (\n \"Oops! The URL you provided is invalid. Please double-check and try again.\"\n)\n\n# Same semantics as open_webui.config (ENABLE_RAG_LOCAL_WEB_FETCH / WEB_FETCH_FILTER_LIST)\nENABLE_RAG_LOCAL_WEB_FETCH = (\n os.getenv(\"ENABLE_RAG_LOCAL_WEB_FETCH\", \"False\").lower() == \"true\"\n)\n\n_DEFAULT_WEB_FETCH_FILTER_LIST = [\n \"!169.254.169.254\",\n \"!fd00:ec2::254\",\n \"!metadata.google.internal\",\n \"!metadata.azure.com\",\n \"!100.100.100.200\",\n]\n_web_fetch_filter_env = os.getenv(\"WEB_FETCH_FILTER_LIST\", \"\")\nif _web_fetch_filter_env == \"\":\n _web_fetch_filter_env_list: list[str] = []\nelse:\n _web_fetch_filter_env_list = [\n item.strip()\n for item in _web_fetch_filter_env.split(\",\")\n if item.strip()\n ]\nWEB_FETCH_FILTER_LIST = list(\n set(_DEFAULT_WEB_FETCH_FILTER_LIST + _web_fetch_filter_env_list)\n)\n\n\ndef get_allow_block_lists(filter_list):\n allow_list = []\n block_list = []\n\n if filter_list:\n for d in filter_list:\n if d.startswith(\"!\"):\n block_list.append(d[1:].strip())\n else:\n allow_list.append(d.strip())\n\n return allow_list, block_list\n\n\ndef is_string_allowed(\n string: Union[str, Sequence[str]], filter_list: Optional[list[str]] = None\n) -\u003e bool:\n if not filter_list:\n return True\n\n allow_list, block_list = get_allow_block_lists(filter_list)\n strings = [string] if isinstance(string, str) else list(string)\n\n if allow_list:\n if not any(s.endswith(allowed) for s in strings for allowed in allow_list):\n return False\n\n if any(s.endswith(blocked) for s in strings for blocked in block_list):\n return False\n\n return True\n\n\ndef resolve_hostname(hostname):\n # Get address information\n addr_info = socket.getaddrinfo(hostname, None)\n\n # Extract IP addresses from address information\n ipv4_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET]\n ipv6_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET6]\n\n return ipv4_addresses, ipv6_addresses\n\n\ndef _validators_url_accept(url: str) -\u003e bool:\n \"\"\"\n Stand-in for python-validators url(): True if string looks like http(s) URL with host.\n \"\"\"\n try:\n u = url.strip()\n if not u:\n return False\n p = urllib.parse.urlparse(u)\n if p.scheme not in (\"http\", \"https\"):\n return False\n if not p.netloc:\n return False\n return True\n except Exception:\n return False\n\n\ndef _ipv4_private(ip: str) -\u003e bool:\n try:\n a = ipaddress.ip_address(ip)\n return a.version == 4 and a.is_private\n except ValueError:\n return False\n\n\ndef _ipv6_private(ip: str) -\u003e bool:\n try:\n a = ipaddress.ip_address(ip)\n return a.version == 6 and a.is_private\n except ValueError:\n return False\n\n\ndef validate_url(url: Union[str, Sequence[str]]):\n if isinstance(url, str):\n if not _validators_url_accept(url):\n raise ValueError(INVALID_URL)\n\n parsed_url = urllib.parse.urlparse(url)\n\n # Protocol validation - only allow http/https\n if parsed_url.scheme not in [\"http\", \"https\"]:\n log.warning(\n f\"Blocked non-HTTP(S) protocol: {parsed_url.scheme} in URL: {url}\"\n )\n raise ValueError(INVALID_URL)\n\n # Blocklist check using unified filtering logic\n if WEB_FETCH_FILTER_LIST:\n if not is_string_allowed(url, WEB_FETCH_FILTER_LIST):\n log.warning(f\"URL blocked by filter list: {url}\")\n raise ValueError(INVALID_URL)\n\n if not ENABLE_RAG_LOCAL_WEB_FETCH:\n # Local web fetch is disabled, filter out any URLs that resolve to private IP addresses\n parsed_url = urllib.parse.urlparse(url)\n # Get IPv4 and IPv6 addresses\n ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname)\n # Check if any of the resolved addresses are private\n # This is technically still vulnerable to DNS rebinding attacks, as we don\u0027t control WebBaseLoader\n for ip in ipv4_addresses:\n if _ipv4_private(ip):\n raise ValueError(INVALID_URL)\n for ip in ipv6_addresses:\n if _ipv6_private(ip):\n raise ValueError(INVALID_URL)\n return True\n elif isinstance(url, Sequence):\n return all(validate_url(u) for u in url)\n else:\n return False\n\nif __name__ == \"__main__\":\n logging.basicConfig(level=logging.INFO)\n # url = \"https://127.0.0.1:6666\\@1.1.1.1\"\n url = \"https://127.0.0.1:6666\"\n validate_url(url)\n response = requests.get(url)\n print(response.text)\n\n```\nAs you can see, the current check on 127.0.0.1:6666 successfully identified it as an internal network IP and blocked it.\n\n\u003cimg width=\"1428\" height=\"273\" alt=\"QQ20260322-203503-22-4\" src=\"https://github.com/user-attachments/assets/cf29b639-d4fe-409e-a516-2424d608739f\" /\u003e\n\nHowever, for https://127.0.0.1:6666\\@1.1.1.1/, the hostname extracted by validate_url is 1.1.1.1, which is considered a public IP address and therefore passes validation. In reality, this URL is being used to request the internal IP address 127.0.0.1:6666, resulting in an SSRF bypass.\n\n\u003cimg width=\"2255\" height=\"786\" alt=\"QQ20260322-203750-22-5\" src=\"https://github.com/user-attachments/assets/050bc6a4-760f-4d7a-8b52-056778097cd1\" /\u003e\n\n### PoC\n```\nhttp://127.0.0.1:6666\\@baidu.com\n```\n\n### Impact\nSSRF",
"id": "GHSA-8w7q-q5jp-jvgx",
"modified": "2026-05-15T23:55:29Z",
"published": "2026-05-14T20:27:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-8w7q-q5jp-jvgx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45400"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`"
}
GHSA-8W86-M9H8-HVQG
Vulnerability from github – Published: 2026-07-16 20:05 – Updated: 2026-07-16 20:05Impact
The SQL IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrators) could therefore:
- Server-Side Request Forgery (CWE-918): cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g.
169.254.169.254) and internal-only services, and ingest the responses as queryable records. - Arbitrary local file read (CWE-22): read local files reachable by the server process (e.g.
/etc/passwd, credential files) by importingfile://paths, exposing their contents as records.
The server administration endpoint (/api/v1/server) was already restricted to the root user and was not affected; the exposure was through the database SQL command/query endpoints (/api/v1/command, /api/v1/query).
A related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.
Affected component
integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java (no host allow-list for http(s); no path validation for file://), reached from engine/.../query/sql/parser/ImportDatabaseStatement.java.
Patches
IMPORT DATABASEnow requires the administrativeupdateSecuritypermission (no-op in embedded mode).- Import sources are validated in
SourceDiscovery: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (arcadedb.server.security.importBlockLocalNetworks, defaulttrue), and an optional local-path allow-list (arcadedb.server.security.importAllowedLocalPaths) restrictsfile://reads. - The XML importer now disables DTD processing and external entities.
Fixed in commit referenced by pull request #4422.
Workarounds
Restrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.
Credit
Reported by Bin Luo (luob87709@gmail.com).
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.arcadedb:arcadedb-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54077"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-776",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-16T20:05:56Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nThe SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only `root`/administrators) could therefore:\n\n- **Server-Side Request Forgery (CWE-918):** cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. `169.254.169.254`) and internal-only services, and ingest the responses as queryable records.\n- **Arbitrary local file read (CWE-22):** read local files reachable by the server process (e.g. `/etc/passwd`, credential files) by importing `file://` paths, exposing their contents as records.\n\nThe server administration endpoint (`/api/v1/server`) was already restricted to the `root` user and was **not** affected; the exposure was through the database SQL command/query endpoints (`/api/v1/command`, `/api/v1/query`).\n\nA related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.\n\n### Affected component\n\n`integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java` (no host allow-list for http(s); no path validation for `file://`), reached from `engine/.../query/sql/parser/ImportDatabaseStatement.java`.\n\n### Patches\n\n- `IMPORT DATABASE` now requires the administrative `updateSecurity` permission (no-op in embedded mode).\n- Import sources are validated in `SourceDiscovery`: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (`arcadedb.server.security.importBlockLocalNetworks`, default `true`), and an optional local-path allow-list (`arcadedb.server.security.importAllowedLocalPaths`) restricts `file://` reads.\n- The XML importer now disables DTD processing and external entities.\n\nFixed in commit referenced by pull request [#4422](https://github.com/ArcadeData/arcadedb/pull/4422).\n\n### Workarounds\n\nRestrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.\n\n### Credit\n\nReported by Bin Luo (luob87709@gmail.com).",
"id": "GHSA-8w86-m9h8-hvqg",
"modified": "2026-07-16T20:05:56Z",
"published": "2026-07-16T20:05:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
},
{
"type": "PACKAGE",
"url": "https://github.com/ArcadeData/arcadedb"
},
{
"type": "WEB",
"url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users"
}
GHSA-8WG4-H2WP-63R5
Vulnerability from github – Published: 2025-04-04 18:31 – Updated: 2025-04-04 18:31A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-3254"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T16:15:40Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-8wg4-h2wp-63r5",
"modified": "2025-04-04T18:31:07Z",
"published": "2025-04-04T18:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3254"
},
{
"type": "WEB",
"url": "https://github.com/caigo8/CVE-md/blob/main/admintwo/SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.303324"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.303324"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.548979"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8WMW-PRW8-2GGM
Vulnerability from github – Published: 2026-04-17 15:31 – Updated: 2026-04-24 21:03Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "markhuot/craftql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-31317"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-18T01:03:36Z",
"nvd_published_at": "2026-04-17T14:16:33Z",
"severity": "MODERATE"
},
"details": "Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file.",
"id": "GHSA-8wmw-prw8-2ggm",
"modified": "2026-04-24T21:03:56Z",
"published": "2026-04-17T15:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31317"
},
{
"type": "PACKAGE",
"url": "https://github.com/markhuot/craftql"
},
{
"type": "WEB",
"url": "https://github.com/stormmmg/craftql_ssrf"
},
{
"type": "WEB",
"url": "https://github.com/stormmmg/craftql_ssrf/blob/master/craftql-ssrf-en/README_detail.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Craftql vulnerable to Server-Side Request Forgery"
}
GHSA-8WX4-4FR5-G6R8
Vulnerability from github – Published: 2025-06-03 18:30 – Updated: 2025-06-03 18:30A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-5510"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-03T17:15:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-8wx4-4fr5-g6r8",
"modified": "2025-06-03T18:30:41Z",
"published": "2025-06-03T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5510"
},
{
"type": "WEB",
"url": "https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md"
},
{
"type": "WEB",
"url": "https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#2ssrf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310924"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310924"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584489"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8X3Q-JPJH-QH5C
Vulnerability from github – Published: 2026-08-31 20:28 – Updated: 2026-08-31 20:28Summary
elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the fsock_get_contents() fallback.
An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address.
The URL validation checks the first resolved IP, but fsock_get_contents() opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated.
The response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF.
The most accurate classification is:
- Vulnerability: SSRF protection bypass
- Exploitation technique: DNS rebinding
- Root cause: TOCTOU/double DNS resolution without IP pinning
Affected versions
Confirmed affected:
- elFinder 2.1.69, commit
8f2c3ffafcdd52cf4515f1eec172f4eee44552ad - the current
masterbranch inspected on 24 July 2026
The earliest affected version has not been determined.
Preconditions
The demonstrated readback path requires:
- PHP without the cURL extension (
curl_exec()unavailable); - access to the URL upload functionality;
- permission to upload a MIME type returned by the target service;
- network connectivity from the PHP process to the internal target;
- DNS resolution behavior compatible with low or zero TTL responses.
Authentication requirements depend on the application integrating the elFinder connector. The attached reproduction connector is intentionally minimal and unauthenticated.
Technical details
validate_address() resolves the supplied hostname with gethostbyname(), rejects loopback and private ranges, and stores the accepted address in $info['ip']:
https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2587-L2655
get_remote_contents() then selects cURL when available, otherwise fsock_get_contents():
https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2673-L2689
The cURL implementation correctly pins the validated IP using CURLOPT_RESOLVE:
https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2709-L2736
However, the socket fallback ignores $info['ip'] and connects using $arr['host']:
$fp = fsockopen(
$ssl . $arr['host'],
$arr['port'],
$errno,
$errstr,
$connect_timeout
);
Relevant code:
https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2762-L2866
Consequently, the address checked by validate_address() is not necessarily the address used by the socket connection.
The same problem is present after redirects: the redirect URL is validated, but the recursive socket request again connects using the hostname rather than the validated IP.
Proof of concept
A Docker-based reproduction is attached as poc.zip.
The laboratory:
- downloads the official elFinder 2.1.69 release during the build;
- verifies that the package version is 2.1.69;
- verifies that
curl_exec()is unavailable; - does not modify the elFinder core;
- runs a deterministic DNS server and an HTTP service bound only to loopback.
Build and run:
docker build -t elfinder-ssrf-repro poc
docker run --rm -p 127.0.0.1:8081:8081 elfinder-ssrf-repro
Open:
http://127.0.0.1:8081/poc/index.html
In the elFinder interface:
- Select "Upload".
- Paste the following URL:
http://rebind.test:9001/secret.txt
- Wait for the upload to complete.
- Open the resulting
secret.txtfile.
Observed content:
INTERNAL_SECRET_MANUAL
The PoC DNS server responds as follows:
first A resolution -> 203.0.113.10
subsequent A resolutions -> 127.0.0.1
Expected logs include:
DNS rebind.test type=1 answer=203.0.113.10 count=1
DNS rebind.test type=1 answer=127.0.0.1 count=2
GET /secret.txt
203.0.113.10 is used only as a deterministic laboratory address that passes the current private-address checks. The actual connection reaches 127.0.0.1:9001.
A redirect variant is also included:
http://rebind.test:9001/redirect-secret
It produces the same readable internal content.
Security impact
An attacker may cause the elFinder server to issue HTTP GET requests to services reachable from the PHP process, including:
- loopback services;
- private network services;
- link-local services where reachable;
- internal administrative or application endpoints.
Because the response body is saved and exposed through elFinder, sensitive internal information may be disclosed.
The demonstrated primitive is limited to HTTP GET requests and does not provide arbitrary request methods, bodies, or headers. Integrity and availability impact would depend on the behavior of reachable internal endpoints and are not claimed by this PoC.
Suggested CVSS
For an exposed connector matching the attached PoC:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base score: 8.6 High.
This assumes:
- no authentication is required by the connector;
- the internal service represents a separate security scope;
- disclosure may include highly sensitive internal data.
If authenticated user access is considered an inherent prerequisite, PR:L would result in a score of 7.7 High.
Suggested remediation
The socket connection should use the IP address returned by validate_address() rather than resolving the hostname again.
For HTTPS, the original hostname should still be used for:
- the HTTP
Hostheader; - TLS SNI;
- certificate hostname validation.
This may require replacing fsockopen() with a connection mechanism that supports connecting to the validated IP while explicitly configuring the TLS peer name.
Every redirect destination should be independently validated and its validated IP pinned to that specific connection.
Revalidating the hostname immediately before connecting is not sufficient because it would still leave a validation-to-connection DNS resolution gap.
As a temporary mitigation, URL uploads could be rejected when cURL is unavailable, or deployments could configure urlUploadFilter to reject URL uploads.
Additional observation
After a successful URL fetch, the upload path calls:
get_headers($url, true)
Relevant code:
https://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L3356-L3374
This performs another request using the original hostname without reusing the validated and pinned connection. It may therefore introduce an additional blind SSRF request, potentially even when the cURL download path is selected.
This additional request is not required for the attached non-blind fsock_get_contents() PoC. It should nevertheless be reviewed during remediation. Ideally, filename and response-header information should be collected from the already validated HTTP response instead of issuing a separate request.
Disclosure
Initial private report date: 24/07/2026
Reporter contact: Marco Lunardi - marcolunardi90@gmail.com
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.1.69"
},
"package": {
"ecosystem": "Packagist",
"name": "studio-42/elfinder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.70"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-81889"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-31T20:28:06Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "[poc.zip](https://github.com/user-attachments/files/30352020/poc.zip)\n## Summary\n\nelFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the `fsock_get_contents()` fallback.\n\nAn attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially resolves to an allowed public IP address and subsequently resolves to a loopback or private IP address.\n\nThe URL validation checks the first resolved IP, but `fsock_get_contents()` opens the actual connection using the original hostname. This causes a second DNS resolution and allows the connection to reach an address different from the one that was validated.\n\nThe response from the internal service is saved as an uploaded file and can be read through elFinder. This makes the demonstrated issue a non-blind SSRF.\n\nThe most accurate classification is:\n\n* Vulnerability: SSRF protection bypass \n* Exploitation technique: DNS rebinding\n* Root cause: TOCTOU/double DNS resolution without IP pinning\n\n## Affected versions\n\nConfirmed affected:\n\n* elFinder 2.1.69, commit `8f2c3ffafcdd52cf4515f1eec172f4eee44552ad`\n* the current `master` branch inspected on 24 July 2026\n\nThe earliest affected version has not been determined.\n\n## Preconditions\n\nThe demonstrated readback path requires:\n\n* PHP without the cURL extension (`curl_exec()` unavailable);\n* access to the URL upload functionality;\n* permission to upload a MIME type returned by the target service;\n* network connectivity from the PHP process to the internal target;\n* DNS resolution behavior compatible with low or zero TTL responses.\n\nAuthentication requirements depend on the application integrating the elFinder connector. The attached reproduction connector is intentionally minimal and unauthenticated.\n\n## Technical details\n\n`validate_address()` resolves the supplied hostname with `gethostbyname()`, rejects loopback and private ranges, and stores the accepted address in `$info[\u0027ip\u0027]`:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2587-L2655\n\n`get_remote_contents()` then selects cURL when available, otherwise `fsock_get_contents()`:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2673-L2689\n\nThe cURL implementation correctly pins the validated IP using `CURLOPT_RESOLVE`:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2709-L2736\n\nHowever, the socket fallback ignores `$info[\u0027ip\u0027]` and connects using `$arr[\u0027host\u0027]`:\n\n```php\n$fp = fsockopen(\n $ssl . $arr[\u0027host\u0027],\n $arr[\u0027port\u0027],\n $errno,\n $errstr,\n $connect_timeout\n);\n```\n\nRelevant code:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L2762-L2866\n\nConsequently, the address checked by `validate_address()` is not necessarily the address used by the socket connection.\n\nThe same problem is present after redirects: the redirect URL is validated, but the recursive socket request again connects using the hostname rather than the validated IP.\n\n## Proof of concept\n\nA Docker-based reproduction is attached as `poc.zip`.\n\nThe laboratory:\n\n* downloads the official elFinder 2.1.69 release during the build;\n* verifies that the package version is 2.1.69;\n* verifies that `curl_exec()` is unavailable;\n* does not modify the elFinder core;\n* runs a deterministic DNS server and an HTTP service bound only to loopback.\n\nBuild and run:\n\n```sh\ndocker build -t elfinder-ssrf-repro poc\ndocker run --rm -p 127.0.0.1:8081:8081 elfinder-ssrf-repro\n```\n\nOpen:\n\n```text\nhttp://127.0.0.1:8081/poc/index.html\n```\n\nIn the elFinder interface:\n\n1. Select \"Upload\".\n2. Paste the following URL:\n\n```text\nhttp://rebind.test:9001/secret.txt\n```\n\n3. Wait for the upload to complete.\n4. Open the resulting `secret.txt` file.\n\nObserved content:\n\n```text\nINTERNAL_SECRET_MANUAL\n```\n\nThe PoC DNS server responds as follows:\n\n```text\nfirst A resolution -\u003e 203.0.113.10\nsubsequent A resolutions -\u003e 127.0.0.1\n```\n\nExpected logs include:\n\n```text\nDNS rebind.test type=1 answer=203.0.113.10 count=1\nDNS rebind.test type=1 answer=127.0.0.1 count=2\nGET /secret.txt\n```\n\n`203.0.113.10` is used only as a deterministic laboratory address that passes the current private-address checks. The actual connection reaches `127.0.0.1:9001`.\n\nA redirect variant is also included:\n\n```text\nhttp://rebind.test:9001/redirect-secret\n```\n\nIt produces the same readable internal content.\n\n## Security impact\n\nAn attacker may cause the elFinder server to issue HTTP GET requests to services reachable from the PHP process, including:\n\n* loopback services;\n* private network services;\n* link-local services where reachable;\n* internal administrative or application endpoints.\n\nBecause the response body is saved and exposed through elFinder, sensitive internal information may be disclosed.\n\nThe demonstrated primitive is limited to HTTP GET requests and does not provide arbitrary request methods, bodies, or headers. Integrity and availability impact would depend on the behavior of reachable internal endpoints and are not claimed by this PoC.\n\n## Suggested CVSS\n\nFor an exposed connector matching the attached PoC:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n```\n\nBase score: 8.6 High.\n\nThis assumes:\n\n* no authentication is required by the connector;\n* the internal service represents a separate security scope;\n* disclosure may include highly sensitive internal data.\n\nIf authenticated user access is considered an inherent prerequisite, `PR:L` would result in a score of 7.7 High.\n\n## Suggested remediation\n\nThe socket connection should use the IP address returned by `validate_address()` rather than resolving the hostname again.\n\nFor HTTPS, the original hostname should still be used for:\n\n* the HTTP `Host` header;\n* TLS SNI;\n* certificate hostname validation.\n\nThis may require replacing `fsockopen()` with a connection mechanism that supports connecting to the validated IP while explicitly configuring the TLS peer name.\n\nEvery redirect destination should be independently validated and its validated IP pinned to that specific connection.\n\nRevalidating the hostname immediately before connecting is not sufficient because it would still leave a validation-to-connection DNS resolution gap.\n\nAs a temporary mitigation, URL uploads could be rejected when cURL is unavailable, or deployments could configure `urlUploadFilter` to reject URL uploads.\n\n## Additional observation\n\nAfter a successful URL fetch, the upload path calls:\n\n```php\nget_headers($url, true)\n```\n\nRelevant code:\n\nhttps://github.com/Studio-42/elFinder/blob/2.1.69/php/elFinder.class.php#L3356-L3374\n\nThis performs another request using the original hostname without reusing the validated and pinned connection. It may therefore introduce an additional blind SSRF request, potentially even when the cURL download path is selected.\n\nThis additional request is not required for the attached non-blind `fsock_get_contents()` PoC. It should nevertheless be reviewed during remediation. Ideally, filename and response-header information should be collected from the already validated HTTP response instead of issuing a separate request.\n\n## Disclosure\n\nInitial private report date: `24/07/2026`\n\nReporter contact: `Marco Lunardi - marcolunardi90@gmail.com`",
"id": "GHSA-8x3q-jpjh-qh5c",
"modified": "2026-08-31T20:28:06Z",
"published": "2026-08-31T20:28:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c"
},
{
"type": "WEB",
"url": "https://github.com/Studio-42/elFinder/commit/191372c1bbebbd36fb55af79a84b9984861390ff"
},
{
"type": "WEB",
"url": "https://github.com/Studio-42/elFinder/commit/6d997386cd0f1abab4706c220b46b0aea0ecff51"
},
{
"type": "PACKAGE",
"url": "https://github.com/Studio-42/elFinder"
},
{
"type": "WEB",
"url": "https://github.com/Studio-42/elFinder/releases/tag/2.1.70"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.