Search

Find a vulnerability

Search criteria

    4 vulnerabilities by webstudio-is

    CVE-2026-113596 (GCVE-0-2026-113596)

    Vulnerability from nvd – Published: 2026-10-20 15:40 – Updated: 2026-10-23 01:43
    VLAI
    Title
    Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
    Summary
    Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
    Severity
    2.3 (Low)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.1 (Low)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-23 01:43 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8194 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    webstudio-is webstudio Affected: 0 , < 0.256.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-02-20 21:05
    Credits
    lighthousekeeper1212 leediay153 from Viettel Post
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113596",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T01:43:46.570337Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T01:43:56.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "webstudio",
          "repo": "https://github.com/webstudio-is/webstudio",
          "vendor": "webstudio-is",
          "versions": [
            {
              "lessThan": "0.256.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lighthousekeeper1212"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-02-20T21:05:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users\u0027 project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user\u0027s project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:25.087Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/webstudio-is/webstudio/issues/5621"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6"
        },
        {
          "name": "webstudio 0.256.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/webstudio-is/webstudio/releases/tag/0.256.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.ts"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.ts"
        },
        {
          "name": "VulnCheck Advisory: Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids"
        }
      ],
      "title": "Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113596",
    "datePublished": "2026-10-20T15:40:25.087Z",
    "dateReserved": "2026-10-20T11:48:38.957Z",
    "dateUpdated": "2026-10-23T01:43:56.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-86119 (GCVE-0-2026-86119)

    Vulnerability from nvd – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
    VLAI
    Title
    Webstudio through 0.296.0 SSRF via /cgi proxy routes
    Summary
    Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    8.6 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 17:06 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8194 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    webstudio-is webstudio Affected: 0 , ≤ 0.296.0 (semver)
        cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-06-13 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:06:17.796062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:23:11.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/webstudio-is/webstudio",
          "product": "webstudio",
          "repo": "https://github.com/webstudio-is/webstudio",
          "vendor": "webstudio-is",
          "versions": [
            {
              "lessThanOrEqual": "0.296.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.296.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-06-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:21:06.231Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #5816",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/webstudio-is/webstudio/issues/5816"
        },
        {
          "name": "cgi.image.$.ts absolute-URL fetch branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.image.$.ts"
        },
        {
          "name": "cgi.video.$.ts absolute-URL fetch branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.video.$.ts"
        },
        {
          "name": "cgi.asset.$.ts absolute-URL fetch branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.asset.$.ts"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/webstudio-is/webstudio"
        },
        {
          "name": "VulnCheck Advisory: Webstudio through 0.296.0 SSRF via /cgi proxy routes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webstudio-through-0.296.0-ssrf-via-cgi-proxy-routes"
        }
      ],
      "title": "Webstudio through 0.296.0 SSRF via /cgi proxy routes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86119",
    "datePublished": "2026-09-05T09:59:08.747Z",
    "dateReserved": "2026-09-05T01:59:22.058Z",
    "dateUpdated": "2026-09-24T14:21:06.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-113596 (GCVE-0-2026-113596)

    Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-23 01:43
    VLAI
    Title
    Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
    Summary
    Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
    Severity
    2.3 (Low)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.1 (Low)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-23 01:43 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8194 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    webstudio-is webstudio Affected: 0 , < 0.256.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-02-20 21:05
    Credits
    lighthousekeeper1212 leediay153 from Viettel Post
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113596",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T01:43:46.570337Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T01:43:56.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "webstudio",
          "repo": "https://github.com/webstudio-is/webstudio",
          "vendor": "webstudio-is",
          "versions": [
            {
              "lessThan": "0.256.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lighthousekeeper1212"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-02-20T21:05:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users\u0027 project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user\u0027s project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:25.087Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/webstudio-is/webstudio/issues/5621"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6"
        },
        {
          "name": "webstudio 0.256.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/webstudio-is/webstudio/releases/tag/0.256.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.ts"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.ts"
        },
        {
          "name": "VulnCheck Advisory: Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids"
        }
      ],
      "title": "Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113596",
    "datePublished": "2026-10-20T15:40:25.087Z",
    "dateReserved": "2026-10-20T11:48:38.957Z",
    "dateUpdated": "2026-10-23T01:43:56.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-86119 (GCVE-0-2026-86119)

    Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
    VLAI
    Title
    Webstudio through 0.296.0 SSRF via /cgi proxy routes
    Summary
    Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    8.6 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 17:06 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8194 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    webstudio-is webstudio Affected: 0 , ≤ 0.296.0 (semver)
        cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-06-13 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:06:17.796062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:23:11.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/webstudio-is/webstudio",
          "product": "webstudio",
          "repo": "https://github.com/webstudio-is/webstudio",
          "vendor": "webstudio-is",
          "versions": [
            {
              "lessThanOrEqual": "0.296.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:webstudio:ultimate_loan_manager:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.296.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-06-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:21:06.231Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #5816",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/webstudio-is/webstudio/issues/5816"
        },
        {
          "name": "cgi.image.$.ts absolute-URL fetch branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.image.$.ts"
        },
        {
          "name": "cgi.video.$.ts absolute-URL fetch branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.video.$.ts"
        },
        {
          "name": "cgi.asset.$.ts absolute-URL fetch branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.asset.$.ts"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/webstudio-is/webstudio"
        },
        {
          "name": "VulnCheck Advisory: Webstudio through 0.296.0 SSRF via /cgi proxy routes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webstudio-through-0.296.0-ssrf-via-cgi-proxy-routes"
        }
      ],
      "title": "Webstudio through 0.296.0 SSRF via /cgi proxy routes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86119",
    "datePublished": "2026-09-05T09:59:08.747Z",
    "dateReserved": "2026-09-05T01:59:22.058Z",
    "dateUpdated": "2026-09-24T14:21:06.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}