Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for once-campfire by basecamp

    CVE-2026-100355 (GCVE-0-2026-100355)

    Vulnerability from nvd – Published: 2026-10-30 14:10 – Updated: 2026-10-30 14:10
    VLAI
    Title
    Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
    Summary
    Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.
    Severity
    3.1 (Low)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    basecamp once-campfire Affected: < 1.4.5
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "once-campfire",
          "vendor": "basecamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby\u0027s `IPAddr#private?\u00a0``\u00a0IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T14:10:34.695Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/basecamp/once-campfire/security/advisories/GHSA-gjm7-g266-w3wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/basecamp/once-campfire/security/advisories/GHSA-gjm7-g266-w3wj"
        },
        {
          "name": "https://github.com/basecamp/once-campfire/pull/225",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/once-campfire/pull/225"
        },
        {
          "name": "https://github.com/basecamp/once-campfire/commit/69e8cd788593cf421c32626a5273c0b449ceee9b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/once-campfire/commit/69e8cd788593cf421c32626a5273c0b449ceee9b"
        },
        {
          "name": "https://github.com/basecamp/once-campfire/releases/tag/v1.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/once-campfire/releases/tag/v1.4.5"
        }
      ],
      "source": {
        "advisory": "GHSA-gjm7-g266-w3wj",
        "discovery": "UNKNOWN"
      },
      "title": "Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100355",
    "datePublished": "2026-10-30T14:10:34.695Z",
    "dateReserved": "2026-09-25T19:19:54.697Z",
    "dateUpdated": "2026-10-30T14:10:34.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-100355 (GCVE-0-2026-100355)

    Vulnerability from cvelistv5 – Published: 2026-10-30 14:10 – Updated: 2026-10-30 14:10
    VLAI
    Title
    Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
    Summary
    Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.
    Severity
    3.1 (Low)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 8083 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    basecamp once-campfire Affected: < 1.4.5
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "once-campfire",
          "vendor": "basecamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby\u0027s `IPAddr#private?\u00a0``\u00a0IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T14:10:34.695Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/basecamp/once-campfire/security/advisories/GHSA-gjm7-g266-w3wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/basecamp/once-campfire/security/advisories/GHSA-gjm7-g266-w3wj"
        },
        {
          "name": "https://github.com/basecamp/once-campfire/pull/225",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/once-campfire/pull/225"
        },
        {
          "name": "https://github.com/basecamp/once-campfire/commit/69e8cd788593cf421c32626a5273c0b449ceee9b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/once-campfire/commit/69e8cd788593cf421c32626a5273c0b449ceee9b"
        },
        {
          "name": "https://github.com/basecamp/once-campfire/releases/tag/v1.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/once-campfire/releases/tag/v1.4.5"
        }
      ],
      "source": {
        "advisory": "GHSA-gjm7-g266-w3wj",
        "discovery": "UNKNOWN"
      },
      "title": "Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100355",
    "datePublished": "2026-10-30T14:10:34.695Z",
    "dateReserved": "2026-09-25T19:19:54.697Z",
    "dateUpdated": "2026-10-30T14:10:34.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}