CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4646 vulnerabilities reference this CWE, most recent first.
GHSA-QF3Q-9F3H-CJP9
Vulnerability from github – Published: 2024-08-05 21:29 – Updated: 2024-08-05 21:29NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. As of time of publication, no patch is available, but other mitigation strategies are available. Users may avoid exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nextchat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.11.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-49785"
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-05T21:29:23Z",
"nvd_published_at": "2024-03-12T00:15:26Z",
"severity": "CRITICAL"
},
"details": "NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. As of time of publication, no patch is available, but other mitigation strategies are available. Users may avoid exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources.",
"id": "GHSA-qf3q-9f3h-cjp9",
"modified": "2024-08-05T21:29:23Z",
"published": "2024-08-05T21:29:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49785"
},
{
"type": "PACKAGE",
"url": "https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web"
},
{
"type": "WEB",
"url": "https://www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint"
}
GHSA-QF5V-Q897-M77R
Vulnerability from github – Published: 2025-09-16 15:32 – Updated: 2025-09-16 15:32The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.
{
"affected": [],
"aliases": [
"CVE-2025-59436"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T06:16:05Z",
"severity": "LOW"
},
"details": "The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.",
"id": "GHSA-qf5v-q897-m77r",
"modified": "2025-09-16T15:32:31Z",
"published": "2025-09-16T15:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59436"
},
{
"type": "WEB",
"url": "https://github.com/indutny/node-ip/issues/160"
},
{
"type": "WEB",
"url": "https://cosmosofcyberspace.github.io/CVE-Application-Document.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QF94-9355-3GFF
Vulnerability from github – Published: 2025-05-07 15:31 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress allows Server Side Request Forgery. This issue affects WebinarPress: from n/a through 1.33.27.
{
"affected": [],
"aliases": [
"CVE-2025-47635"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T15:16:16Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress allows Server Side Request Forgery. This issue affects WebinarPress: from n/a through 1.33.27.",
"id": "GHSA-qf94-9355-3gff",
"modified": "2026-04-01T18:35:04Z",
"published": "2025-05-07T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47635"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-webinarsystem/vulnerability/wordpress-webinarpress-1-33-27-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QFM9-R3P9-8HCP
Vulnerability from github – Published: 2025-02-20 00:32 – Updated: 2025-02-20 00:32The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918)
Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not validate the Host header of incoming HTTP/HTTPS requests.
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
{
"affected": [],
"aliases": [
"CVE-2024-37359"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-19T23:15:10Z",
"severity": "HIGH"
},
"details": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) \n\n\n\n\u00a0\n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not validate the Host header of incoming HTTP/HTTPS requests.\n\n\n\n\u00a0\n\n\n\nBy providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.",
"id": "GHSA-qfm9-r3p9-8hcp",
"modified": "2025-02-20T00:32:03Z",
"published": "2025-02-20T00:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37359"
},
{
"type": "WEB",
"url": "https://support.pentaho.com/hc/en-us/articles/34296789835917--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Server-Side-Request-Forgery-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-37359"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QFXW-56C6-7PJG
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2026-02-17 21:31Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
{
"affected": [],
"aliases": [
"CVE-2020-7796"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-18T22:15:00Z",
"severity": "MODERATE"
},
"details": "Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.",
"id": "GHSA-qfxw-56c6-7pjg",
"modified": "2026-02-17T21:31:12Z",
"published": "2022-05-24T17:09:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7796"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7796"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QG2F-VRG7-HR49
Vulnerability from github – Published: 2025-05-06 18:30 – Updated: 2025-05-06 21:30MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.
{
"affected": [],
"aliases": [
"CVE-2025-45250"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T17:16:12Z",
"severity": "MODERATE"
},
"details": "MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.",
"id": "GHSA-qg2f-vrg7-hr49",
"modified": "2025-05-06T21:30:48Z",
"published": "2025-05-06T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45250"
},
{
"type": "WEB",
"url": "https://github.com/Anike-x/CVE-2025-45250"
},
{
"type": "WEB",
"url": "https://github.com/zmister2016/MrDoc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QG89-QWWH-5F3J
Vulnerability from github – Published: 2026-05-19 20:09 – Updated: 2026-06-09 10:32Resolution
SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.
Documentation:
- https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelisting
- https://docs.sillytavern.app/administration/#security-checklist
Note on future SSRF findings
Since the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.
Summary
SillyTavern 1.17.0 exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the /search response body.
Confirmed version: SillyTavern 1.17.0 from the audited source tree. Broader affected versions and patched versions should be confirmed by the maintainer.
Details
The /api/search/searxng route in src/endpoints/search.js reads baseUrl from request.body and performs no allowlist, IP range, DNS, or scheme validation before making outbound requests.
Core vulnerable path:
router.post('/searxng', async (request, response) => {
const { baseUrl, query, preferences, categories } = request.body;
if (!baseUrl || !query) {
return response.status(400).send('Missing required parameters');
}
const mainPageUrl = new URL(baseUrl);
const mainPageRequest = await fetch(mainPageUrl, { headers: visitHeaders });
...
const searchUrl = new URL('/search', baseUrl);
const searchParams = new URLSearchParams();
searchParams.append('q', query);
...
const searchResult = await fetch(searchUrl, { headers: visitHeaders });
...
const data = await searchResult.text();
return response.send(data);
});
src/server-startup.js mounts this router at /api/search, and src/server-main.js applies login middleware before the API routes. This means the source is a remote authenticated POST request and the sink is server-side fetch() to attacker-selected hosts.
PoC
Attacker prerequisites: a valid SillyTavern web session, or access to a deployment where user accounts are disabled.
Start an internal mock service on the target host:
import http from 'node:http';
http.createServer((req, res) => {
if (req.url === '/') {
res.writeHead(200, { 'Content-Type': 'text/html' });
return res.end('<html><head><link href="/client.css" rel="stylesheet"></head></html>');
}
if (req.url === '/client.css') {
res.writeHead(200, { 'Content-Type': 'text/css' });
return res.end('body{}');
}
if (req.url.startsWith('/search?q=')) {
res.writeHead(200, { 'Content-Type': 'text/plain' });
return res.end('INTERNAL-SEARCH-RESULT');
}
res.writeHead(404);
res.end('not found');
}).listen(9091, '127.0.0.1');
Then send:
POST /api/search/searxng HTTP/1.1
Host: TARGET:8000
Cookie: session-...=...
X-CSRF-Token: <token from /csrf-token>
Content-Type: application/json
{"baseUrl":"http://127.0.0.1:9091/","query":"x"}
Result based on the route logic: SillyTavern first fetches http://127.0.0.1:9091/, then fetches http://127.0.0.1:9091/search?q=x, and returns INTERNAL-SEARCH-RESULT to the attacker.
Impact
This is an authenticated SSRF primitive with arbitrary host and port selection. It can disclose responses from loopback or internal HTTP services reachable from the SillyTavern host and may enable interaction with internal admin panels, development services, cloud metadata endpoints in applicable deployments, or service discovery across private networks.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.17.0"
},
"package": {
"ecosystem": "npm",
"name": "sillytavern"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46372"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-19T20:09:52Z",
"nvd_published_at": "2026-05-29T19:16:25Z",
"severity": "HIGH"
},
"details": "## Resolution\n\nSillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.\n\nDocumentation: \n\n- https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelisting\n- https://docs.sillytavern.app/administration/#security-checklist\n\n## Note on future SSRF findings\n\nSince the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.\n\n## Summary\nSillyTavern 1.17.0 exposes `/api/search/searxng`, which accepts attacker-controlled `baseUrl` and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point `baseUrl` at an internal or loopback HTTP service and receive the `/search` response body.\n\nConfirmed version: SillyTavern 1.17.0 from the audited source tree. Broader affected versions and patched versions should be confirmed by the maintainer.\n\n## Details\nThe `/api/search/searxng` route in `src/endpoints/search.js` reads `baseUrl` from `request.body` and performs no allowlist, IP range, DNS, or scheme validation before making outbound requests.\n\nCore vulnerable path:\n\n```js\nrouter.post(\u0027/searxng\u0027, async (request, response) =\u003e {\n const { baseUrl, query, preferences, categories } = request.body;\n if (!baseUrl || !query) {\n return response.status(400).send(\u0027Missing required parameters\u0027);\n }\n\n const mainPageUrl = new URL(baseUrl);\n const mainPageRequest = await fetch(mainPageUrl, { headers: visitHeaders });\n ...\n const searchUrl = new URL(\u0027/search\u0027, baseUrl);\n const searchParams = new URLSearchParams();\n searchParams.append(\u0027q\u0027, query);\n ...\n const searchResult = await fetch(searchUrl, { headers: visitHeaders });\n ...\n const data = await searchResult.text();\n return response.send(data);\n});\n```\n\n`src/server-startup.js` mounts this router at `/api/search`, and `src/server-main.js` applies login middleware before the API routes. This means the source is a remote authenticated POST request and the sink is server-side `fetch()` to attacker-selected hosts.\n\n## PoC\nAttacker prerequisites: a valid SillyTavern web session, or access to a deployment where user accounts are disabled.\n\nStart an internal mock service on the target host:\n\n```js\nimport http from \u0027node:http\u0027;\n\nhttp.createServer((req, res) =\u003e {\n if (req.url === \u0027/\u0027) {\n res.writeHead(200, { \u0027Content-Type\u0027: \u0027text/html\u0027 });\n return res.end(\u0027\u003chtml\u003e\u003chead\u003e\u003clink href=\"/client.css\" rel=\"stylesheet\"\u003e\u003c/head\u003e\u003c/html\u003e\u0027);\n }\n if (req.url === \u0027/client.css\u0027) {\n res.writeHead(200, { \u0027Content-Type\u0027: \u0027text/css\u0027 });\n return res.end(\u0027body{}\u0027);\n }\n if (req.url.startsWith(\u0027/search?q=\u0027)) {\n res.writeHead(200, { \u0027Content-Type\u0027: \u0027text/plain\u0027 });\n return res.end(\u0027INTERNAL-SEARCH-RESULT\u0027);\n }\n res.writeHead(404);\n res.end(\u0027not found\u0027);\n}).listen(9091, \u0027127.0.0.1\u0027);\n```\n\nThen send:\n\n```http\nPOST /api/search/searxng HTTP/1.1\nHost: TARGET:8000\nCookie: session-...=...\nX-CSRF-Token: \u003ctoken from /csrf-token\u003e\nContent-Type: application/json\n\n{\"baseUrl\":\"http://127.0.0.1:9091/\",\"query\":\"x\"}\n```\n\nResult based on the route logic: SillyTavern first fetches `http://127.0.0.1:9091/`, then fetches `http://127.0.0.1:9091/search?q=x`, and returns `INTERNAL-SEARCH-RESULT` to the attacker.\n\n## Impact\nThis is an authenticated SSRF primitive with arbitrary host and port selection. It can disclose responses from loopback or internal HTTP services reachable from the SillyTavern host and may enable interaction with internal admin panels, development services, cloud metadata endpoints in applicable deployments, or service discovery across private networks.",
"id": "GHSA-qg89-qwwh-5f3j",
"modified": "2026-06-09T10:32:23Z",
"published": "2026-05-19T20:09:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-qg89-qwwh-5f3j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46372"
},
{
"type": "PACKAGE",
"url": "https://github.com/SillyTavern/SillyTavern"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl"
}
GHSA-QG93-CPF3-386G
Vulnerability from github – Published: 2023-06-20 09:30 – Updated: 2024-01-12 09:30It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.
{
"affected": [],
"aliases": [
"CVE-2023-26435"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-20T08:15:09Z",
"severity": "MODERATE"
},
"details": "It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.\n\n",
"id": "GHSA-qg93-cpf3-386g",
"modified": "2024-01-12T09:30:27Z",
"published": "2023-06-20T09:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26435"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json"
},
{
"type": "WEB",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Jun/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QGQH-6WPP-27C4
Vulnerability from github – Published: 2023-04-15 03:30 – Updated: 2024-04-04 03:29OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).
{
"affected": [],
"aliases": [
"CVE-2022-43699"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-15T02:15:00Z",
"severity": "MODERATE"
},
"details": "OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).",
"id": "GHSA-qgqh-6wpp-27c4",
"modified": "2024-04-04T03:29:02Z",
"published": "2023-04-15T03:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43699"
},
{
"type": "WEB",
"url": "https://open-xchange.com"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2023/Feb/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QH4C-XF7M-GXFC
Vulnerability from github – Published: 2026-01-28 16:14 – Updated: 2026-07-17 16:17Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods obtain and process media from URLs provided by users, using different Python parsing libraries when restricting the target host. These two parsing libraries have different interpretations of backslashes, which allows the host name restriction to be bypassed. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.
This vulnerability is particularly critical in containerized environments like llm-d, where a compromised vLLM pod could be used to scan the internal network, interact with other pods, and potentially cause Denial of Service or access sensitive data. For example, an attacker could make the vLLM pod send malicious requests to an internal llm-d management endpoint, leading to system instability by falsely reporting metrics like the KV cache state.
Details
The core of the vulnerability lies in the MediaConnector.load_from_url method and its asynchronous counterpart. These methods accept a URL string to fetch media content (images, audio, video).
def load_from_url( self, url: str, media_io: MediaIO[_M], *, fetch_timeout: int | None = None, ) -> _M: # type: ignore[type-var] url_spec = urlparse(url) if url_spec.scheme.startswith("http"): self._assert_url_in_allowed_media_domains(url_spec) connection = self.connection data = connection.get_bytes( url, timeout=fetch_timeout, allow_redirects=envs.VLLM_MEDIA_URL_ALLOW_REDIRECTS, ) return media_io.load_bytes(data)
The URL validation uses the urlparse function from Python's urllib module, while the request is made using the request function from Python's requests module. The requests module's underlying URL parsing is implemented using the parse_url function from Python's urllib3. These two parsing functions follow different URL specifications; one is implemented according to the RFC 3986 specification, and the other is implemented according to the WHATWG Living Standard. There is a difference in how the two functions handle backslashes (\) in URLs, which allows the hostname restriction to be bypassed.
Fix
- https://github.com/vllm-project/vllm/pull/32746
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vllm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24779"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-28T16:14:28Z",
"nvd_published_at": "2026-01-27T22:15:57Z",
"severity": "HIGH"
},
"details": "### Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project\u0027s multimodal feature set. The load_from_url and load_from_url_async methods obtain and process media from URLs provided by users, using different Python parsing libraries when restricting the target host. These two parsing libraries have different interpretations of backslashes, which allows the host name restriction to be bypassed. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.\n\nThis vulnerability is particularly critical in containerized environments like `llm-d`, where a compromised vLLM pod could be used to scan the internal network, interact with other pods, and potentially cause Denial of Service or access sensitive data. For example, an attacker could make the vLLM pod send malicious requests to an internal `llm-d` management endpoint, leading to system instability by falsely reporting metrics like the KV cache state.\n\n### Details\nThe core of the vulnerability lies in the `MediaConnector.load_from_url` method and its asynchronous counterpart. These methods accept a URL string to fetch media content (images, audio, video).\n\n\u003e def load_from_url(\n\u003e self,\n\u003e url: str,\n\u003e media_io: MediaIO[_M],\n\u003e *,\n\u003e fetch_timeout: int | None = None,\n\u003e ) -\u003e _M: # type: ignore[type-var]\n\u003e url_spec = urlparse(url)\n\u003e \n\u003e if url_spec.scheme.startswith(\"http\"):\n\u003e self._assert_url_in_allowed_media_domains(url_spec)\n\u003e \n\u003e connection = self.connection\n\u003e data = connection.get_bytes(\n\u003e url,\n\u003e timeout=fetch_timeout,\n\u003e allow_redirects=envs.VLLM_MEDIA_URL_ALLOW_REDIRECTS,\n\u003e )\n\u003e \n\u003e return media_io.load_bytes(data)\n\nThe URL validation uses the `urlparse` function from Python\u0027s `urllib` module, while the request is made using the `request` function from Python\u0027s `requests` module. The `requests` module\u0027s underlying URL parsing is implemented using the `parse_url` function from Python\u0027s `urllib3`. These two parsing functions follow different URL specifications; one is implemented according to the RFC 3986 specification, and the other is implemented according to the WHATWG Living Standard. There is a difference in how the two functions handle backslashes (`\\`) in URLs, which allows the hostname restriction to be bypassed.\n\n### Fix\n\n* https://github.com/vllm-project/vllm/pull/32746",
"id": "GHSA-qh4c-xf7m-gxfc",
"modified": "2026-07-17T16:17:31Z",
"published": "2026-01-28T16:14:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24779"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/pull/32746"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/commit/f46d576c54fb8aeec5fc70560e850bed38ef17d7"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24779.json"
},
{
"type": "WEB",
"url": "https://pypi.org/project/vllm"
},
{
"type": "PACKAGE",
"url": "https://github.com/vllm-project/vllm"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2020.yaml"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qh4c-xf7m-gxfc"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433624"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-24779"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3782"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30087"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19712"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10184"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.