Vulnerability-Lookup

GHSA-F28J-GX5R-P78J

Vulnerability from github – Published: 2026-03-23 15:30 – Updated: 2026-04-18 06:30

Details

A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-4589"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-23T14:16:35Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.",
  "id": "GHSA-f28j-gx5r-p78j",
  "modified": "2026-04-18T06:30:14Z",
  "published": "2026-03-23T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4589"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.352425"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.352425"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.775467"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/775467"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/352425"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/352425/cti"
    },
    {
      "type": "WEB",
      "url": "https://vulnplus-note.wetolink.com/share/UTZQq38f9VyI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2C6-8JG6-287F

Vulnerability from github – Published: 2026-07-18 18:30 – Updated: 2026-07-18 18:30

Details

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-16128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-18T17:16:38Z",
    "severity": "MODERATE"
  },
  "details": "A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-f2c6-8jg6-287f",
  "modified": "2026-07-18T18:30:21Z",
  "published": "2026-07-18T18:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zevorn/rt-claw/issues/140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zevorn/rt-claw"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-16128"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/856873"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379840"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379840/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2CG-3CWW-MCQ8

Vulnerability from github – Published: 2026-04-17 12:31 – Updated: 2026-04-17 12:31

Details

GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to any Windows system on which the agent is installed and which provides communication via SMB or WebDav.

This issue was fixed in version 2.8.33.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-5131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-17T11:16:11Z",
    "severity": "MODERATE"
  },
  "details": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to\u00a0any Windows system\u00a0on which the agent is installed and which provides communication via SMB or WebDav.\n\nThis issue was fixed in version 2.8.33.",
  "id": "GHSA-f2cg-3cww-mcq8",
  "modified": "2026-04-17T12:31:25Z",
  "published": "2026-04-17T12:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5131"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/posts/2026/04/CVE-2026-5131"
    },
    {
      "type": "WEB",
      "url": "https://www.nomios.pl/greenmod"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2F4-JWFQ-4Q5V

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03

Details

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-14328"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-27T20:15:00Z",
    "severity": "LOW"
  },
  "details": "A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.",
  "id": "GHSA-f2f4-jwfq-4q5v",
  "modified": "2022-05-24T19:03:34Z",
  "published": "2022-05-24T19:03:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14328"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856786"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-F2G2-3GV9-7Q7G

Vulnerability from github – Published: 2026-04-27 06:31 – Updated: 2026-04-27 06:31

Details

A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that "[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it."

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-7084"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-27T04:16:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that \"[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it.\"",
  "id": "GHSA-f2g2-3gv9-7q7g",
  "modified": "2026-04-27T06:31:24Z",
  "published": "2026-04-27T06:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7084"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95#issuecomment-4208181221"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HBAI-Ltd/Toonflow-app"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/799582"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359659"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359659/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2G8-C8V2-QMMR

Vulnerability from github – Published: 2026-10-12 21:31 – Updated: 2026-10-12 21:31

Details

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-85471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-12T19:16:40Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.",
  "id": "GHSA-f2g8-c8v2-qmmr",
  "modified": "2026-10-12T21:31:55Z",
  "published": "2026-10-12T21:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85471"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-85471"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528221"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F2MJ-X2JJ-WJVC

Vulnerability from github – Published: 2026-10-14 09:31 – Updated: 2026-10-14 15:32

Details

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.

Severity

4.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-85345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-14T07:17:03Z",
    "severity": "MODERATE"
  },
  "details": "The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server\u0027s fetch reveals whether an internal resource responds and its HTTP status, but the resource\u0027s contents are not returned to the attacker.",
  "id": "GHSA-f2mj-x2jj-wjvc",
  "modified": "2026-10-14T15:32:17Z",
  "published": "2026-10-14T09:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85345"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/d1a5d12d-a7ce-43e1-b7c5-752453bc97e9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F2RJ-M42R-6JM2

Vulnerability from github – Published: 2022-10-25 20:22 – Updated: 2023-08-30 09:52

Summary

Skipper vulnerable to SSRF via X-Skipper-Proxy

Details

Impact

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.

Patches

The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper >=v0.13.237.

Workarounds

Use dropRequestHeader("X-Skipper-Proxy") filter

References

https://github.com/zalando/skipper/releases/tag/v0.13.237

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/zalando/skipper/issues/new/choose
Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zalando/skipper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.237"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-38580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-25T20:22:29Z",
    "nvd_published_at": "2022-10-25T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nSkipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.\n\n### Patches\nThe problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237.\nUsers need to upgrade to skipper `\u003e=v0.13.237`.\n\n### Workarounds\n\nUse `dropRequestHeader(\"X-Skipper-Proxy\")` filter\n\n### References\n\nhttps://github.com/zalando/skipper/releases/tag/v0.13.237\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in https://github.com/zalando/skipper/issues/new/choose\n* Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5",
  "id": "GHSA-f2rj-m42r-6jm2",
  "modified": "2023-08-30T09:52:10Z",
  "published": "2022-10-25T20:22:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38580"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/pull/2058"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/commit/842634347da8fe77e396f66edea79d329fd72130"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zalando/skipper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.13.237"
    },
    {
      "type": "WEB",
      "url": "https://pastebin.com/dXxpgPAK"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-1086"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html"
    },
    {
      "type": "WEB",
      "url": "http://skipper.com"
    },
    {
      "type": "WEB",
      "url": "http://zalando.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skipper vulnerable to SSRF via X-Skipper-Proxy"
}

GHSA-F2W4-MP23-HR7Q

Vulnerability from github – Published: 2022-06-28 00:01 – Updated: 2022-07-07 00:00

Details

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-1977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-27T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Import Export All WordPress Images, Users \u0026 Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks",
  "id": "GHSA-f2w4-mp23-hr7q",
  "modified": "2022-07-07T00:00:27Z",
  "published": "2022-06-28T00:01:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1977"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/1b640519-75e1-48cb-944e-b9bff9de6d3d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F359-R3PV-2PHF

Vulnerability from github – Published: 2026-03-26 18:10 – Updated: 2026-04-08 23:15

Summary

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Details

Summary

isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but url_get_contents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

Root Cause

Check-time: isSSRFSafeURL() at objects/functions.php:4066 resolves the hostname and validates the IP.

Use-time: url_get_contents() at objects/functions.php:1990 calls file_get_contents() with PHP's default follow_location=1 — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.

Affected endpoint: objects/aVideoEncoderReceiveImage.json.php at lines 67-68, 107-108, 135-136, 160-161:

if (isValidURL($_REQUEST['downloadURL_image']) && isSSRFSafeURL($_REQUEST['downloadURL_image'])) {
    $content = url_get_contents($_REQUEST['downloadURL_image']);

Proof of Concept

Attacker sets up https://attacker.com/redir to respond with 302 Location: http://169.254.169.254/latest/meta-data/
Authenticated user (with upload+edit permissions) triggers image download:

GET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&...

isSSRFSafeURL() resolves attacker.com → public IP → passes validation
url_get_contents() follows 302 redirect to 169.254.169.254 → SSRF

Impact

Cloud metadata access (AWS IMDSv1, GCP, Azure)
Internal network service access
Bypasses the existing SSRF protection that was added to prevent exactly this class of attack

Note

The curl path in url_get_contents() does NOT set CURLOPT_FOLLOWLOCATION so it is not affected. Only the file_get_contents and wget fallback paths are vulnerable.

Suggested Fix

Set follow_location to 0 in the stream context and handle redirects manually with re-validation, or add isSSRFSafeURL() check inside url_get_contents() after resolving the final URL.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T18:10:48Z",
    "nvd_published_at": "2026-03-27T15:16:58Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.\n\n## Root Cause\n\n**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.\n\n**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP\u0027s default `follow_location=1` \u2014 redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.\n\n**Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161:\n```php\nif (isValidURL($_REQUEST[\u0027downloadURL_image\u0027]) \u0026\u0026 isSSRFSafeURL($_REQUEST[\u0027downloadURL_image\u0027])) {\n    $content = url_get_contents($_REQUEST[\u0027downloadURL_image\u0027]);\n```\n\n## Proof of Concept\n\n1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/`\n2. Authenticated user (with upload+edit permissions) triggers image download:\n```\nGET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir\u0026...\n```\n3. `isSSRFSafeURL()` resolves `attacker.com` \u2192 public IP \u2192 passes validation\n4. `url_get_contents()` follows 302 redirect to `169.254.169.254` \u2192 SSRF\n\n## Impact\n\n- Cloud metadata access (AWS IMDSv1, GCP, Azure)\n- Internal network service access\n- Bypasses the existing SSRF protection that was added to prevent exactly this class of attack\n\n## Note\n\nThe curl path in `url_get_contents()` does NOT set `CURLOPT_FOLLOWLOCATION` so it is not affected. Only the `file_get_contents` and `wget` fallback paths are vulnerable.\n\n## Suggested Fix\n\nSet `follow_location` to `0` in the stream context and handle redirects manually with re-validation, or add `isSSRFSafeURL()` check inside `url_get_contents()` after resolving the final URL.",
  "id": "GHSA-f359-r3pv-2phf",
  "modified": "2026-04-08T23:15:59Z",
  "published": "2026-03-26T18:10:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints"
}

CWE-918

Server-Side Request Forgery (SSRF)

Impact

Patches

Workarounds

References

For more information

Summary

Root Cause

Proof of Concept

Impact

Note

Suggested Fix

CAPEC-664: Server Side Request Forgery