CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6669 vulnerabilities reference this CWE, most recent first.
GHSA-FWFP-H68W-2HCR
Vulnerability from github – Published: 2026-05-27 00:31 – Updated: 2026-06-30 21:31A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1. This vulnerability was reported via the GitHub Bug Bounty program.
{
"affected": [],
"aliases": [
"CVE-2026-9312"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T00:16:39Z",
"severity": "CRITICAL"
},
"details": "A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1. This vulnerability was reported via the GitHub Bug Bounty program.",
"id": "GHSA-fwfp-h68w-2hcr",
"modified": "2026-06-30T21:31:35Z",
"published": "2026-05-27T00:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9312"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.20"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.11"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FWG4-Q55Q-W62P
Vulnerability from github – Published: 2023-11-21 00:30 – Updated: 2025-05-19 15:30Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
{
"affected": [],
"aliases": [
"CVE-2023-6199"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-20T23:15:06Z",
"severity": "HIGH"
},
"details": "Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.",
"id": "GHSA-fwg4-q55q-w62p",
"modified": "2025-05-19T15:30:29Z",
"published": "2023-11-21T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6199"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/imagination"
},
{
"type": "WEB",
"url": "https://www.bookstackapp.com/blog/bookstack-release-v23-10-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWHC-MM9Q-MQQ8
Vulnerability from github – Published: 2024-05-22 21:30 – Updated: 2024-05-23 14:18A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "vufind/vufind"
},
"ranges": [
{
"events": [
{
"introduced": "2.4"
},
{
"fixed": "9.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-25737"
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-23T14:13:15Z",
"nvd_published_at": "2024-05-22T19:15:08Z",
"severity": "CRITICAL"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.",
"id": "GHSA-fwhc-mm9q-mqq8",
"modified": "2024-05-23T14:18:28Z",
"published": "2024-05-22T21:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25737"
},
{
"type": "WEB",
"url": "https://github.com/vufind-org/vufind/commit/345d00f7d7f1c581f46742effdac70e803b3847b"
},
{
"type": "WEB",
"url": "https://github.com/vufind-org/vufind/commit/51f2ddac0dc1047e6fd3b27e6d984b19e1601d00"
},
{
"type": "PACKAGE",
"url": "https://github.com/vufind-org/vufind"
},
{
"type": "WEB",
"url": "https://vufind.org/wiki/security:cve-2024-25737"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "VuFind Server-Side Request Forgery (SSRF) vulnerability"
}
GHSA-FWHW-CHW4-GH37
Vulnerability from github – Published: 2026-02-02 09:30 – Updated: 2026-02-02 21:23A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-parent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-1518"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T21:23:18Z",
"nvd_published_at": "2026-02-02T08:16:06Z",
"severity": "LOW"
},
"details": "A flaw was found in Keycloak\u2019s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.",
"id": "GHSA-fwhw-chw4-gh37",
"modified": "2026-02-02T21:23:18Z",
"published": "2026-02-02T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1518"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-1518"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433727"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Server-Side Request Forgery (SSRF) vulnerability"
}
GHSA-FWJQ-J8GC-2F24
Vulnerability from github – Published: 2022-06-24 00:00 – Updated: 2022-06-30 00:00OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.
{
"affected": [],
"aliases": [
"CVE-2022-34013"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.",
"id": "GHSA-fwjq-j8gc-2f24",
"modified": "2022-06-30T00:00:37Z",
"published": "2022-06-24T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34013"
},
{
"type": "WEB",
"url": "https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWP2-VG7P-F8X2
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-14 21:31A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-90814"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T20:17:02Z",
"severity": "LOW"
},
"details": "A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-fwp2-vg7p-f8x2",
"modified": "2026-09-14T21:31:46Z",
"published": "2026-09-14T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90814"
},
{
"type": "WEB",
"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/81"
},
{
"type": "WEB",
"url": "https://github.com/cosmicstack-labs/mercury-agent"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90814"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/922880"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403316"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403316/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FWP6-82JC-56PC
Vulnerability from github – Published: 2026-09-15 15:32 – Updated: 2026-09-15 21:31An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
{
"affected": [],
"aliases": [
"CVE-2026-79425"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T15:17:21Z",
"severity": "HIGH"
},
"details": "An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.",
"id": "GHSA-fwp6-82jc-56pc",
"modified": "2026-09-15T21:31:14Z",
"published": "2026-09-15T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79425"
},
{
"type": "WEB",
"url": "https://github.com/crmeb/CRMEB"
},
{
"type": "WEB",
"url": "https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-79425.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWQW-PR3C-3J3R
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-23 00:03An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
{
"affected": [],
"aliases": [
"CVE-2022-26499"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T05:15:00Z",
"severity": "CRITICAL"
},
"details": "An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it\u0027s possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.",
"id": "GHSA-fwqw-pr3c-3j3r",
"modified": "2022-04-23T00:03:21Z",
"published": "2022-04-16T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26499"
},
{
"type": "WEB",
"url": "https://downloads.asterisk.org/pub/security"
},
{
"type": "WEB",
"url": "https://downloads.asterisk.org/pub/security/AST-2022-002.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5285"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWVG-2739-22V7
Vulnerability from github – Published: 2023-12-29 19:36 – Updated: 2023-12-29 19:36Impact
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.
Patches
The issue was fixed in miniflare@3.20231030.2.
Workarounds
Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option.
References
- https://github.com/cloudflare/workers-sdk/pull/4532
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "miniflare"
},
"ranges": [
{
"events": [
{
"introduced": "3.20230821.0"
},
{
"fixed": "3.20231030.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-7078"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-29T19:36:41Z",
"nvd_published_at": "2023-12-29T12:15:47Z",
"severity": "HIGH"
},
"details": "### Impact\nSending specially crafted HTTP requests to Miniflare\u0027s server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in `wrangler` until `3.19.0`), an attacker on the local network could access other local servers.\n\n### Patches\nThe issue was fixed in `miniflare@3.20231030.2`.\n\n### Workarounds\nEnsure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the `host: \"127.0.0.1\"` option.\n\n### References\n- https://github.com/cloudflare/workers-sdk/pull/4532\n",
"id": "GHSA-fwvg-2739-22v7",
"modified": "2023-12-29T19:36:41Z",
"published": "2023-12-29T19:36:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7078"
},
{
"type": "WEB",
"url": "https://github.com/cloudflare/workers-sdk/pull/4532"
},
{
"type": "PACKAGE",
"url": "https://github.com/cloudflare/workers-sdk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Miniflare vulnerable to Server-Side Request Forgery (SSRF)"
}
GHSA-FX75-97X2-V9J2
Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-11 21:32The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
{
"affected": [],
"aliases": [
"CVE-2026-14860"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T07:16:47Z",
"severity": "MODERATE"
},
"details": "The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.",
"id": "GHSA-fx75-97x2-v9j2",
"modified": "2026-08-11T21:32:29Z",
"published": "2026-08-10T09:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14860"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/ea752266-9bff-4c36-91aa-9aca0232c7af"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.