CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5865 vulnerabilities reference this CWE, most recent first.
GHSA-582G-J67J-5Q79
Vulnerability from github – Published: 2026-04-06 06:30 – Updated: 2026-04-06 06:30A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-5618"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-06T04:16:14Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-582g-j67j-5q79",
"modified": "2026-04-06T06:30:29Z",
"published": "2026-04-06T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5618"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/785572"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/355408"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/355408/cti"
},
{
"type": "WEB",
"url": "https://vulnplus-note.wetolink.com/share/3VtzyzYgcS4b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5846-7QM3-R52J
Vulnerability from github – Published: 2026-07-31 16:58 – Updated: 2026-07-31 16:58Summary
is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.
POC
Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf:
import { is_url_safe } from '../dist/helpers.js';
import dns from 'dns';
dns.setServers(['1.1.1.1']);
const TARGET = 'http://localhost/admin';
console.log(`Testing: ${TARGET}`);
console.log(`Current DNS Servers: ${dns.getServers()}`);
const result = await is_url_safe(TARGET);
if (result === true) {
console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.');
} else {
console.log('dssrf blocked localhost.');
}
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.4"
},
"package": {
"ecosystem": "npm",
"name": "dssrf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54729"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T16:58:42Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nis_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.\n\n## POC\n\nExample to simulate 1.1.1.1 in version before 1.5.0 of dssrf:\n\n```js\nimport { is_url_safe } from \u0027../dist/helpers.js\u0027;\nimport dns from \u0027dns\u0027;\n\n\ndns.setServers([\u00271.1.1.1\u0027]);\n\nconst TARGET = \u0027http://localhost/admin\u0027;\n\nconsole.log(`Testing: ${TARGET}`);\nconsole.log(`Current DNS Servers: ${dns.getServers()}`);\n\nconst result = await is_url_safe(TARGET);\n\nif (result === true) {\n console.log(\u0027dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.\u0027);\n} else {\n console.log(\u0027dssrf blocked localhost.\u0027);\n}\n```",
"id": "GHSA-5846-7qm3-r52j",
"modified": "2026-07-31T16:58:42Z",
"published": "2026-07-31T16:58:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j"
},
{
"type": "WEB",
"url": "https://github.com/HackingRepo/dssrf-js/pull/102"
},
{
"type": "WEB",
"url": "https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d"
},
{
"type": "PACKAGE",
"url": "https://github.com/HackingRepo/dssrf-js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "dssrf: any users using 1.1.1.1 DNS is impacted by SSRF"
}
GHSA-5853-Q5HG-7GX5
Vulnerability from github – Published: 2026-07-24 00:32 – Updated: 2026-07-24 00:329Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-63313"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-23T22:16:52Z",
"severity": "HIGH"
},
"details": "9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.",
"id": "GHSA-5853-q5hg-7gx5",
"modified": "2026-07-24T00:32:33Z",
"published": "2026-07-24T00:32:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63313"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5868-VCX5-GWMP
Vulnerability from github – Published: 2023-12-14 09:30 – Updated: 2024-10-08 18:33Unauthenticated LFI/SSRF in JCDashboards component for Joomla.
{
"affected": [],
"aliases": [
"CVE-2023-40630"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-14T09:15:41Z",
"severity": "CRITICAL"
},
"details": "Unauthenticated LFI/SSRF in JCDashboards component for Joomla.",
"id": "GHSA-5868-vcx5-gwmp",
"modified": "2024-10-08T18:33:05Z",
"published": "2023-12-14T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40630"
},
{
"type": "WEB",
"url": "https://extensions.joomla.org/extension/jcdashboards"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-586R-QXPV-M44Q
Vulnerability from github – Published: 2024-10-11 21:31 – Updated: 2024-10-15 21:30A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure.
{
"affected": [],
"aliases": [
"CVE-2024-46468"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-11T21:15:07Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress \u003c= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure.",
"id": "GHSA-586r-qxpv-m44q",
"modified": "2024-10-15T21:30:37Z",
"published": "2024-10-11T21:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46468"
},
{
"type": "WEB",
"url": "https://github.com/JPressProjects/jpress/issues/190"
},
{
"type": "WEB",
"url": "https://gist.github.com/ilikeoyt/b396bbb9ef858105c46e999630e7afbe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-587R-MC96-6F2P
Vulnerability from github – Published: 2026-05-11 14:45 – Updated: 2026-06-08 23:42Summary
The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog.
Description
ProjectScanner.scan_remote() takes a url, branch, and requirements_name, then constructs a raw GitHub URL by calling:
githubusercontent_url = url.replace("github", "raw.githubusercontent")
req_url = f"{githubusercontent_url}/{branch}/{requirements_name}"
resp = requests.get(url=req_url, auth=token)
Because this logic does not parse or validate the hostname, a crafted URL such as:
http://github@127.0.0.1:18081/owner/repo
is transformed into:
http://raw.githubusercontent@127.0.0.1:18081/owner/repo/main/requirements.txt
Requests interprets this as an HTTP request to 127.0.0.1:18081, and GuardDog includes the configured GitHub credentials via HTTP Basic Auth.
Reproduction summary
- Start an HTTP listener on
127.0.0.1:18081that logs the request path andAuthorizationheader. - Set
GIT_USERNAME=aliceandGH_TOKEN=supersecret. - Call
PypiRequirementsScanner().scan_remote("http://github@127.0.0.1:18081/owner/repo", "main", "requirements.txt"). - Observe a request to
/owner/repo/main/requirements.txtwithAuthorization: Basic YWxpY2U6c3VwZXJzZWNyZXQ=.
Key code paths
guarddog/scanners/scanner.py:361-365
Practical impact
This can expose repository-scanning infrastructure to:
- theft of the GitHub PAT configured in GH_TOKEN
- SSRF to internal or localhost services reachable by the scanner
- attacker-controlled dependency file content returned by the malicious endpoint
Prior public disclosure check
As of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.
Suggested fix
Parse the input URL, require hostname == "github.com", validate the path shape (owner/repo), build the raw URL from parsed components instead of string replacement, and never send GitHub credentials to non-GitHub hosts.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "guarddog"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "2.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44971"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-11T14:45:08Z",
"nvd_published_at": "2026-05-27T15:16:29Z",
"severity": "HIGH"
},
"details": "# Summary\nThe programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller\u0027s GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the `GH_TOKEN` used by GuardDog.\n\n# Description\n`ProjectScanner.scan_remote()` takes a `url`, `branch`, and `requirements_name`, then constructs a raw GitHub URL by calling:\n\n```python\ngithubusercontent_url = url.replace(\"github\", \"raw.githubusercontent\")\nreq_url = f\"{githubusercontent_url}/{branch}/{requirements_name}\"\nresp = requests.get(url=req_url, auth=token)\n```\n\nBecause this logic does not parse or validate the hostname, a crafted URL such as:\n\n```text\nhttp://github@127.0.0.1:18081/owner/repo\n```\n\nis transformed into:\n\n```text\nhttp://raw.githubusercontent@127.0.0.1:18081/owner/repo/main/requirements.txt\n```\n\nRequests interprets this as an HTTP request to `127.0.0.1:18081`, and GuardDog includes the configured GitHub credentials via HTTP Basic Auth.\n\n# Reproduction summary\n1. Start an HTTP listener on `127.0.0.1:18081` that logs the request path and `Authorization` header.\n2. Set `GIT_USERNAME=alice` and `GH_TOKEN=supersecret`.\n3. Call `PypiRequirementsScanner().scan_remote(\"http://github@127.0.0.1:18081/owner/repo\", \"main\", \"requirements.txt\")`.\n4. Observe a request to `/owner/repo/main/requirements.txt` with `Authorization: Basic YWxpY2U6c3VwZXJzZWNyZXQ=`.\n\n# Key code paths\n- `guarddog/scanners/scanner.py:361-365`\n\n# Practical impact\nThis can expose repository-scanning infrastructure to:\n- theft of the GitHub PAT configured in `GH_TOKEN`\n- SSRF to internal or localhost services reachable by the scanner\n- attacker-controlled dependency file content returned by the malicious endpoint\n\n# Prior public disclosure check\nAs of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.\n\n# Suggested fix\nParse the input URL, require `hostname == \"github.com\"`, validate the path shape (`owner/repo`), build the raw URL from parsed components instead of string replacement, and never send GitHub credentials to non-GitHub hosts.",
"id": "GHSA-587r-mc96-6f2p",
"modified": "2026-06-08T23:42:22Z",
"published": "2026-05-11T14:45:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44971"
},
{
"type": "PACKAGE",
"url": "https://github.com/DataDog/guarddog"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration"
}
GHSA-5899-42J8-FXPR
Vulnerability from github – Published: 2026-02-14 09:31 – Updated: 2026-02-14 09:31The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2026-1249"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-14T09:16:11Z",
"severity": "MODERATE"
},
"details": "The MP3 Audio Player \u2013 Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the \u0027load_lyrics_ajax_callback\u0027 function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-5899-42j8-fxpr",
"modified": "2026-02-14T09:31:34Z",
"published": "2026-02-14T09:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1249"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3453076/mp3-music-player-by-sonaar/trunk/sonaar-music.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/261aad1e-43fc-4927-a97d-85a001863023?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-58G2-VGPG-335Q
Vulnerability from github – Published: 2023-03-31 21:30 – Updated: 2023-04-07 22:47request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/darklynx/request-baskets"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-27163"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-31T22:44:28Z",
"nvd_published_at": "2023-03-31T20:15:00Z",
"severity": "MODERATE"
},
"details": "request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.",
"id": "GHSA-58g2-vgpg-335q",
"modified": "2023-04-07T22:47:43Z",
"published": "2023-03-31T21:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27163"
},
{
"type": "WEB",
"url": "https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3"
},
{
"type": "PACKAGE",
"url": "https://github.com/darklynx/request-baskets"
},
{
"type": "WEB",
"url": "https://notes.sjtu.edu.cn/s/MUUhEymt7"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://request-baskets.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "request-baskets vulnerable to Server-Side Request Forgery"
}
GHSA-58RV-96R6-2CPW
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.
{
"affected": [],
"aliases": [
"CVE-2017-17697"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-15T09:29:00Z",
"severity": "HIGH"
},
"details": "The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.",
"id": "GHSA-58rv-96r6-2cpw",
"modified": "2022-05-13T01:27:29Z",
"published": "2022-05-13T01:27:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17697"
},
{
"type": "WEB",
"url": "https://github.com/vmware/harbor/issues/3755"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-58WP-JWCH-FGJ5
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-04 18:30FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context.
{
"affected": [],
"aliases": [
"CVE-2026-9813"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:40Z",
"severity": "MODERATE"
},
"details": "FlowIntel up to version 3.3.0\u00a0contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server\u0027s network context.",
"id": "GHSA-58wp-jwch-fgj5",
"modified": "2026-06-04T18:30:25Z",
"published": "2026-05-28T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9813"
},
{
"type": "WEB",
"url": "https://github.com/flowintel/flowintel/commit/68b523b47854c54bf36fd706c0fd5353063b5409"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.