Search
Find a vulnerability
Search criteria
2 vulnerabilities found for webstudio by webstudio-is
CVE-2026-86119 (GCVE-0-2026-86119)
Vulnerability from nvd – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Webstudio through 0.296.0 SSRF via /cgi proxy routes
Summary
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:06 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/webstudio-is/webstudio/issues/5816 | issue-tracking |
| https://github.com/webstudio-is/webstudio/blob/55… | technical-description |
| https://github.com/webstudio-is/webstudio/blob/55… | technical-description |
| https://github.com/webstudio-is/webstudio/blob/55… | technical-description |
| https://github.com/webstudio-is/webstudio | product |
| https://www.vulncheck.com/advisories/webstudio-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webstudio-is | webstudio |
Affected:
0 , ≤ 0.296.0
(semver)
cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:06:17.796062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:11.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/webstudio-is/webstudio",
"product": "webstudio",
"repo": "https://github.com/webstudio-is/webstudio",
"vendor": "webstudio-is",
"versions": [
{
"lessThanOrEqual": "0.296.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.296.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:06.231Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #5816",
"tags": [
"issue-tracking"
],
"url": "https://github.com/webstudio-is/webstudio/issues/5816"
},
{
"name": "cgi.image.$.ts absolute-URL fetch branch",
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.image.$.ts"
},
{
"name": "cgi.video.$.ts absolute-URL fetch branch",
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.video.$.ts"
},
{
"name": "cgi.asset.$.ts absolute-URL fetch branch",
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.asset.$.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/webstudio-is/webstudio"
},
{
"name": "VulnCheck Advisory: Webstudio through 0.296.0 SSRF via /cgi proxy routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/webstudio-through-0.296.0-ssrf-via-cgi-proxy-routes"
}
],
"title": "Webstudio through 0.296.0 SSRF via /cgi proxy routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86119",
"datePublished": "2026-09-05T09:59:08.747Z",
"dateReserved": "2026-09-05T01:59:22.058Z",
"dateUpdated": "2026-09-24T14:21:06.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86119 (GCVE-0-2026-86119)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Webstudio through 0.296.0 SSRF via /cgi proxy routes
Summary
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:06 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/webstudio-is/webstudio/issues/5816 | issue-tracking |
| https://github.com/webstudio-is/webstudio/blob/55… | technical-description |
| https://github.com/webstudio-is/webstudio/blob/55… | technical-description |
| https://github.com/webstudio-is/webstudio/blob/55… | technical-description |
| https://github.com/webstudio-is/webstudio | product |
| https://www.vulncheck.com/advisories/webstudio-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webstudio-is | webstudio |
Affected:
0 , ≤ 0.296.0
(semver)
cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:06:17.796062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:11.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/webstudio-is/webstudio",
"product": "webstudio",
"repo": "https://github.com/webstudio-is/webstudio",
"vendor": "webstudio-is",
"versions": [
{
"lessThanOrEqual": "0.296.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.296.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:06.231Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #5816",
"tags": [
"issue-tracking"
],
"url": "https://github.com/webstudio-is/webstudio/issues/5816"
},
{
"name": "cgi.image.$.ts absolute-URL fetch branch",
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.image.$.ts"
},
{
"name": "cgi.video.$.ts absolute-URL fetch branch",
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.video.$.ts"
},
{
"name": "cgi.asset.$.ts absolute-URL fetch branch",
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.asset.$.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/webstudio-is/webstudio"
},
{
"name": "VulnCheck Advisory: Webstudio through 0.296.0 SSRF via /cgi proxy routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/webstudio-through-0.296.0-ssrf-via-cgi-proxy-routes"
}
],
"title": "Webstudio through 0.296.0 SSRF via /cgi proxy routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86119",
"datePublished": "2026-09-05T09:59:08.747Z",
"dateReserved": "2026-09-05T01:59:22.058Z",
"dateUpdated": "2026-09-24T14:21:06.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}