CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6643 vulnerabilities reference this CWE, most recent first.
GHSA-GP3H-JQ5W-CHRC
Vulnerability from github – Published: 2023-12-15 18:30 – Updated: 2026-04-28 21:33Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.
{
"affected": [],
"aliases": [
"CVE-2023-49159"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-15T16:15:43Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.",
"id": "GHSA-gp3h-jq5w-chrc",
"modified": "2026-04-28T21:33:21Z",
"published": "2023-12-15T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49159"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/commentluv/wordpress-commentluv-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GP6F-26PC-FR6H
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-16 21:31n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.
{
"affected": [],
"aliases": [
"CVE-2026-85172"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:24Z",
"severity": "MODERATE"
},
"details": "n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.",
"id": "GHSA-gp6f-26pc-fr6h",
"modified": "2026-09-16T21:31:37Z",
"published": "2026-09-03T15:32:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jp9j-jr97-w9pj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85172"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-2.34.1-ssrf-via-request-helper-uri-validation-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GP8M-92X3-Q87G
Vulnerability from github – Published: 2026-08-25 12:31 – Updated: 2026-08-26 21:31Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.
Attacker access requirements:
- Network access to HiveServer2 / Metastore: required (remote attacker model).
- Valid Hive authentication: required.
- CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url in table properties.
- SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.
- Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.
- Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.
- External tables enabled: typically required in practice, and enabled by default in most deployments.
Detection guidance:
- Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.
- Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.
- Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.
- On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.
{
"affected": [],
"aliases": [
"CVE-2026-55976"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T11:16:53Z",
"severity": "CRITICAL"
},
"details": "Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\n\n\nAttacker access requirements:\n\n * Network access to HiveServer2 / Metastore: required (remote attacker model).\n * Valid Hive authentication: required.\n * CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\u00a0in table properties.\n * SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\n * Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\n * Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\n * External tables enabled: typically required in practice, and enabled by default in most deployments.\n\n\n\n\nDetection guidance:\n\n * Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\n * Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\n * Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\n * On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.",
"id": "GHSA-gp8m-92x3-q87g",
"modified": "2026-08-26T21:31:33Z",
"published": "2026-08-25T12:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55976"
},
{
"type": "WEB",
"url": "https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00"
},
{
"type": "WEB",
"url": "https://github.com/apache/hive"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/HIVE-29671"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GPCG-3V88-PXVP
Vulnerability from github – Published: 2026-10-12 15:32 – Updated: 2026-10-12 15:32LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
{
"affected": [],
"aliases": [
"CVE-2026-109200"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T14:17:10Z",
"severity": "MODERATE"
},
"details": "LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.",
"id": "GHSA-gpcg-3v88-pxvp",
"modified": "2026-10-12T15:32:17Z",
"published": "2026-10-12T15:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109200"
},
{
"type": "WEB",
"url": "https://github.com/logicaldoc/community"
},
{
"type": "WEB",
"url": "https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106"
},
{
"type": "WEB",
"url": "https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249"
},
{
"type": "WEB",
"url": "https://github.com/logicaldoc/community/discussions/119"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GPF2-RXQ3-V5RJ
Vulnerability from github – Published: 2026-02-03 00:30 – Updated: 2026-02-03 00:30IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
{
"affected": [],
"aliases": [
"CVE-2025-13096"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-02T23:15:58Z",
"severity": "HIGH"
},
"details": "IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A\u00a0remote attacker could exploit this vulnerability to expose sensitive information or consume memory\u00a0resources.",
"id": "GHSA-gpf2-rxq3-v5rj",
"modified": "2026-02-03T00:30:18Z",
"published": "2026-02-03T00:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13096"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7259321"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-GPP3-CP4H-G5WG
Vulnerability from github – Published: 2023-07-31 21:30 – Updated: 2024-04-04 06:27Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).
{
"affected": [],
"aliases": [
"CVE-2022-42183"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-31T20:15:10Z",
"severity": "CRITICAL"
},
"details": "Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).",
"id": "GHSA-gpp3-cp4h-g5wg",
"modified": "2024-04-04T06:27:40Z",
"published": "2023-07-31T21:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42183"
},
{
"type": "WEB",
"url": "https://docs.precisely.com/docs/sftw/spectrum/release-notes/spectrum-2020-1-S56-release-notes.pdf"
},
{
"type": "WEB",
"url": "https://zxsecurity.co.nz/research/advisories/precisely-spectrum-spatial-analyst-20-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GPQG-PWJF-MJXW
Vulnerability from github – Published: 2026-08-21 00:31 – Updated: 2026-08-21 00:31Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.
{
"affected": [],
"aliases": [
"CVE-2026-69543"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T22:18:00Z",
"severity": "HIGH"
},
"details": "Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-gpqg-pwjf-mjxw",
"modified": "2026-08-21T00:31:22Z",
"published": "2026-08-21T00:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69543"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69543"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPRH-27J3-G5H4
Vulnerability from github – Published: 2026-06-17 14:06 – Updated: 2026-07-20 21:19Summary
The spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path
contained a permitted extension anywhere in the string, and applied a hand-rolled
regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the
cloud-metadata endpoint to be reached with a crafted URL.
Details
The extension matcher is now anchored to the end of the path or immediately before
the query string (/\.(xls|xlsx|xlsm|ods|ots)(\?|$)/i and /\.(csv)(\?|$)/i), so
http://169.254.169.254/credentials/.xlsx no longer satisfies the format gate. The
hand-rolled IP blocklist is removed in favour of useAgent(url) from
request-filtering-agent, which blocks private and loopback ranges at the socket
layer.
Impact
Authenticated users with editor permission could read cloud metadata and other internal HTTP endpoints reachable from the NocoDB process. On affected installs the spreadsheet import path was a credential-exfiltration primitive on cloud hosts.
Credit
This issue was reported by Devel Group Security Research Team through @TREXNEGRO. It was independently reported by @l3tchupkt.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nocodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.301.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53927"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-17T14:06:43Z",
"nvd_published_at": "2026-06-23T21:17:01Z",
"severity": "MODERATE"
},
"details": "### Summary\nThe spreadsheet-fetch endpoint (`axiosRequestMake`) accepted URLs whose path\ncontained a permitted extension anywhere in the string, and applied a hand-rolled\nregex blocklist that omitted `127.0.0.0/8` and `169.254.0.0/16`, allowing the\ncloud-metadata endpoint to be reached with a crafted URL.\n\n### Details\nThe extension matcher is now anchored to the end of the path or immediately before\nthe query string (`/\\.(xls|xlsx|xlsm|ods|ots)(\\?|$)/i` and `/\\.(csv)(\\?|$)/i`), so\n`http://169.254.169.254/credentials/.xlsx` no longer satisfies the format gate. The\nhand-rolled IP blocklist is removed in favour of `useAgent(url)` from\n`request-filtering-agent`, which blocks private and loopback ranges at the socket\nlayer.\n\n### Impact\nAuthenticated users with editor permission could read cloud metadata and other\ninternal HTTP endpoints reachable from the NocoDB process. On affected installs the\nspreadsheet import path was a credential-exfiltration primitive on cloud hosts.\n\n### Credit\nThis issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO).\nIt was independently reported by [@l3tchupkt](https://github.com/l3tchupkt).",
"id": "GHSA-gprh-27j3-g5h4",
"modified": "2026-07-20T21:19:58Z",
"published": "2026-06-17T14:06:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-gprh-27j3-g5h4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53927"
},
{
"type": "PACKAGE",
"url": "https://github.com/nocodb/nocodb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL"
}
GHSA-GPRX-48QQ-VXQR
Vulnerability from github – Published: 2026-09-17 15:32 – Updated: 2026-09-17 15:32Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
{
"affected": [],
"aliases": [
"CVE-2026-66608"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T14:17:17Z",
"severity": "MODERATE"
},
"details": "Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 2.0.19 versions.",
"id": "GHSA-gprx-48qq-vxqr",
"modified": "2026-09-17T15:32:13Z",
"published": "2026-09-17T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66608"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-19-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GPVF-C684-3RMH
Vulnerability from github – Published: 2022-05-25 00:00 – Updated: 2022-06-03 00:00mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.
{
"affected": [],
"aliases": [
"CVE-2022-29309"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-24T03:15:00Z",
"severity": "HIGH"
},
"details": "mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.",
"id": "GHSA-gpvf-c684-3rmh",
"modified": "2022-06-03T00:00:35Z",
"published": "2022-05-25T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29309"
},
{
"type": "WEB",
"url": "https://github.com/wangl1989/mysiteforme/issues/43"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.