CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6492 vulnerabilities reference this CWE, most recent first.
GHSA-X8H5-CPR3-H43M
Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-08-11 12:30A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server.
{
"affected": [],
"aliases": [
"CVE-2026-72606"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T12:17:43Z",
"severity": "HIGH"
},
"details": "A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server.",
"id": "GHSA-x8h5-cpr3-h43m",
"modified": "2026-08-11T12:30:28Z",
"published": "2026-08-11T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72606"
},
{
"type": "WEB",
"url": "https://github.com/pinry/pinry"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X8HW-99FP-GMH6
Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2024-04-04 02:45Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
{
"affected": [],
"aliases": [
"CVE-2019-19999"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-26T04:15:00Z",
"severity": "HIGH"
},
"details": "Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.",
"id": "GHSA-x8hw-99fp-gmh6",
"modified": "2024-04-04T02:45:26Z",
"published": "2022-05-24T17:05:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19999"
},
{
"type": "WEB",
"url": "https://github.com/halo-dev/halo/issues/419"
},
{
"type": "WEB",
"url": "https://github.com/halo-dev/halo/issues/440"
},
{
"type": "WEB",
"url": "https://github.com/halo-dev/halo/compare/v1.1.3-beta.2...v1.2.0-beta.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X8R7-G3FV-CF37
Vulnerability from github – Published: 2026-08-24 03:31 – Updated: 2026-08-24 03:31BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.
{
"affected": [],
"aliases": [
"CVE-2026-78205"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T01:16:57Z",
"severity": "MODERATE"
},
"details": "BentoML\u0027s outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.",
"id": "GHSA-x8r7-g3fv-cf37",
"modified": "2026-08-24T03:31:05Z",
"published": "2026-08-24T03:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78205"
},
{
"type": "WEB",
"url": "https://github.com/bentoml/BentoML/issues/5644"
},
{
"type": "WEB",
"url": "https://github.com/bentoml/BentoML"
},
{
"type": "WEB",
"url": "https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/utils/uri.py#L89-L96"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/bentoml-through-server-side-request-forgery-via-unfiltered-rfc-6598-shared-address-space"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X8RQ-RC7X-5FG5
Vulnerability from github – Published: 2022-01-06 22:24 – Updated: 2025-12-22 17:42uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@uppy/companion"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0086"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-06T19:48:36Z",
"nvd_published_at": "2022-01-04T18:15:00Z",
"severity": "HIGH"
},
"details": "uppy\u0027s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.",
"id": "GHSA-x8rq-rc7x-5fg5",
"modified": "2025-12-22T17:42:04Z",
"published": "2022-01-06T22:24:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0086"
},
{
"type": "WEB",
"url": "https://github.com/transloadit/uppy/pull/3403"
},
{
"type": "WEB",
"url": "https://github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8f"
},
{
"type": "WEB",
"url": "https://github.com/transloadit/uppy"
},
{
"type": "WEB",
"url": "https://github.com/transloadit/uppy/releases/tag/uppy%402.3.3"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "uppy\u0027s companion module is vulnerable to Server-Side Request Forgery (SSRF)"
}
GHSA-X8XM-HQH8-G7PW
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2024-04-04 00:42WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).
{
"affected": [],
"aliases": [
"CVE-2019-12161"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-17T19:29:00Z",
"severity": "HIGH"
},
"details": "WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).",
"id": "GHSA-x8xm-hqh8-g7pw",
"modified": "2024-04-04T00:42:20Z",
"published": "2022-05-24T16:46:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12161"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1550366"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X8XQ-5829-HC86
Vulnerability from github – Published: 2025-09-14 06:30 – Updated: 2025-09-14 06:30A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx Handler. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-10393"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-14T06:15:29Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx Handler. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.",
"id": "GHSA-x8xq-5829-hc86",
"modified": "2025-09-14T06:30:20Z",
"published": "2025-09-14T06:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10393"
},
{
"type": "WEB",
"url": "https://github.com/miurla/morphic/issues/670"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323828"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323828"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.645509"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X8XR-Q2J9-GFC2
Vulnerability from github – Published: 2026-09-27 06:30 – Updated: 2026-09-28 03:30The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
{
"affected": [],
"aliases": [
"CVE-2026-89000"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-27T06:17:19Z",
"severity": "MODERATE"
},
"details": "The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.",
"id": "GHSA-x8xr-q2j9-gfc2",
"modified": "2026-09-28T03:30:26Z",
"published": "2026-09-27T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89000"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/2622b685-d2a9-4bb5-aeef-3aa4ca7adcc4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X9CC-G7V6-8MC3
Vulnerability from github – Published: 2025-07-04 09:31 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7.
{
"affected": [],
"aliases": [
"CVE-2025-28963"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-04T09:15:30Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7.",
"id": "GHSA-x9cc-g7v6-8mc3",
"modified": "2026-04-01T18:35:41Z",
"published": "2025-07-04T09:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28963"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-plugin-3-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X9CC-HF3V-Q44R
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2025-05-08 12:34Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
{
"affected": [],
"aliases": [
"CVE-2020-17386"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-25T08:15:00Z",
"severity": "MODERATE"
},
"details": "Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.",
"id": "GHSA-x9cc-hf3v-q44r",
"modified": "2025-05-08T12:34:28Z",
"published": "2022-05-24T17:26:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17386"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X9FW-V6JG-W952
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2021-34808"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-18T03:15:00Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.",
"id": "GHSA-x9fw-v6jg-w952",
"modified": "2022-05-24T19:05:40Z",
"published": "2022-05-24T19:05:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34808"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_21_10"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.