GHSA-F28J-GX5R-P78J

Vulnerability from github – Published: 2026-03-23 15:30 – Updated: 2026-04-18 06:30

Details

A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-4589"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-23T14:16:35Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.",
  "id": "GHSA-f28j-gx5r-p78j",
  "modified": "2026-04-18T06:30:14Z",
  "published": "2026-03-23T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4589"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.352425"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.352425"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.775467"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/775467"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/352425"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/352425/cti"
    },
    {
      "type": "WEB",
      "url": "https://vulnplus-note.wetolink.com/share/UTZQq38f9VyI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2C6-8JG6-287F

Vulnerability from github – Published: 2026-07-18 18:30 – Updated: 2026-07-18 18:30

Details

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-16128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-18T17:16:38Z",
    "severity": "MODERATE"
  },
  "details": "A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-f2c6-8jg6-287f",
  "modified": "2026-07-18T18:30:21Z",
  "published": "2026-07-18T18:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zevorn/rt-claw/issues/140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zevorn/rt-claw"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-16128"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/856873"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379840"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379840/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2CG-3CWW-MCQ8

Vulnerability from github – Published: 2026-04-17 12:31 – Updated: 2026-04-17 12:31

Details

GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to any Windows system on which the agent is installed and which provides communication via SMB or WebDav.

This issue was fixed in version 2.8.33.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-5131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-17T11:16:11Z",
    "severity": "MODERATE"
  },
  "details": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to\u00a0any Windows system\u00a0on which the agent is installed and which provides communication via SMB or WebDav.\n\nThis issue was fixed in version 2.8.33.",
  "id": "GHSA-f2cg-3cww-mcq8",
  "modified": "2026-04-17T12:31:25Z",
  "published": "2026-04-17T12:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5131"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/posts/2026/04/CVE-2026-5131"
    },
    {
      "type": "WEB",
      "url": "https://www.nomios.pl/greenmod"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2F4-JWFQ-4Q5V

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03

Details

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-14328"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-27T20:15:00Z",
    "severity": "LOW"
  },
  "details": "A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.",
  "id": "GHSA-f2f4-jwfq-4q5v",
  "modified": "2022-05-24T19:03:34Z",
  "published": "2022-05-24T19:03:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14328"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856786"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-F2G2-3GV9-7Q7G

Vulnerability from github – Published: 2026-04-27 06:31 – Updated: 2026-04-27 06:31

Details

A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that "[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it."

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-7084"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-27T04:16:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that \"[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it.\"",
  "id": "GHSA-f2g2-3gv9-7q7g",
  "modified": "2026-04-27T06:31:24Z",
  "published": "2026-04-27T06:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7084"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95#issuecomment-4208181221"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HBAI-Ltd/Toonflow-app"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/799582"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359659"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359659/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F2RJ-M42R-6JM2

Vulnerability from github – Published: 2022-10-25 20:22 – Updated: 2023-08-30 09:52

Summary

Skipper vulnerable to SSRF via X-Skipper-Proxy

Details

Impact

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.

Patches

The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper >=v0.13.237.

Workarounds

Use dropRequestHeader("X-Skipper-Proxy") filter

References

https://github.com/zalando/skipper/releases/tag/v0.13.237

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/zalando/skipper/issues/new/choose
Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zalando/skipper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.237"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-38580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-25T20:22:29Z",
    "nvd_published_at": "2022-10-25T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nSkipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.\n\n### Patches\nThe problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237.\nUsers need to upgrade to skipper `\u003e=v0.13.237`.\n\n### Workarounds\n\nUse `dropRequestHeader(\"X-Skipper-Proxy\")` filter\n\n### References\n\nhttps://github.com/zalando/skipper/releases/tag/v0.13.237\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in https://github.com/zalando/skipper/issues/new/choose\n* Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5",
  "id": "GHSA-f2rj-m42r-6jm2",
  "modified": "2023-08-30T09:52:10Z",
  "published": "2022-10-25T20:22:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38580"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/pull/2058"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/commit/842634347da8fe77e396f66edea79d329fd72130"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zalando/skipper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.13.237"
    },
    {
      "type": "WEB",
      "url": "https://pastebin.com/dXxpgPAK"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-1086"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html"
    },
    {
      "type": "WEB",
      "url": "http://skipper.com"
    },
    {
      "type": "WEB",
      "url": "http://zalando.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skipper vulnerable to SSRF via X-Skipper-Proxy"
}

GHSA-F2W4-MP23-HR7Q

Vulnerability from github – Published: 2022-06-28 00:01 – Updated: 2022-07-07 00:00

Details

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-1977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-27T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Import Export All WordPress Images, Users \u0026 Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks",
  "id": "GHSA-f2w4-mp23-hr7q",
  "modified": "2022-07-07T00:00:27Z",
  "published": "2022-06-28T00:01:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1977"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/1b640519-75e1-48cb-944e-b9bff9de6d3d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F359-R3PV-2PHF

Vulnerability from github – Published: 2026-03-26 18:10 – Updated: 2026-04-08 23:15

Summary

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Details

Summary

isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but url_get_contents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

Root Cause

Check-time: isSSRFSafeURL() at objects/functions.php:4066 resolves the hostname and validates the IP.

Use-time: url_get_contents() at objects/functions.php:1990 calls file_get_contents() with PHP's default follow_location=1 — redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.

Affected endpoint: objects/aVideoEncoderReceiveImage.json.php at lines 67-68, 107-108, 135-136, 160-161:

if (isValidURL($_REQUEST['downloadURL_image']) && isSSRFSafeURL($_REQUEST['downloadURL_image'])) {
    $content = url_get_contents($_REQUEST['downloadURL_image']);

Proof of Concept

Attacker sets up https://attacker.com/redir to respond with 302 Location: http://169.254.169.254/latest/meta-data/
Authenticated user (with upload+edit permissions) triggers image download:

GET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir&...

isSSRFSafeURL() resolves attacker.com → public IP → passes validation
url_get_contents() follows 302 redirect to 169.254.169.254 → SSRF

Impact

Cloud metadata access (AWS IMDSv1, GCP, Azure)
Internal network service access
Bypasses the existing SSRF protection that was added to prevent exactly this class of attack

Note

The curl path in url_get_contents() does NOT set CURLOPT_FOLLOWLOCATION so it is not affected. Only the file_get_contents and wget fallback paths are vulnerable.

Suggested Fix

Set follow_location to 0 in the stream context and handle redirects manually with re-validation, or add isSSRFSafeURL() check inside url_get_contents() after resolving the final URL.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T18:10:48Z",
    "nvd_published_at": "2026-03-27T15:16:58Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.\n\n## Root Cause\n\n**Check-time:** `isSSRFSafeURL()` at `objects/functions.php:4066` resolves the hostname and validates the IP.\n\n**Use-time:** `url_get_contents()` at `objects/functions.php:1990` calls `file_get_contents()` with PHP\u0027s default `follow_location=1` \u2014 redirects are followed without re-validation. The wget fallback at line 2047 also follows redirects by default.\n\n**Affected endpoint:** `objects/aVideoEncoderReceiveImage.json.php` at lines 67-68, 107-108, 135-136, 160-161:\n```php\nif (isValidURL($_REQUEST[\u0027downloadURL_image\u0027]) \u0026\u0026 isSSRFSafeURL($_REQUEST[\u0027downloadURL_image\u0027])) {\n    $content = url_get_contents($_REQUEST[\u0027downloadURL_image\u0027]);\n```\n\n## Proof of Concept\n\n1. Attacker sets up `https://attacker.com/redir` to respond with `302 Location: http://169.254.169.254/latest/meta-data/`\n2. Authenticated user (with upload+edit permissions) triggers image download:\n```\nGET /objects/aVideoEncoderReceiveImage.json.php?downloadURL_image=https://attacker.com/redir\u0026...\n```\n3. `isSSRFSafeURL()` resolves `attacker.com` \u2192 public IP \u2192 passes validation\n4. `url_get_contents()` follows 302 redirect to `169.254.169.254` \u2192 SSRF\n\n## Impact\n\n- Cloud metadata access (AWS IMDSv1, GCP, Azure)\n- Internal network service access\n- Bypasses the existing SSRF protection that was added to prevent exactly this class of attack\n\n## Note\n\nThe curl path in `url_get_contents()` does NOT set `CURLOPT_FOLLOWLOCATION` so it is not affected. Only the `file_get_contents` and `wget` fallback paths are vulnerable.\n\n## Suggested Fix\n\nSet `follow_location` to `0` in the stream context and handle redirects manually with re-validation, or add `isSSRFSafeURL()` check inside `url_get_contents()` after resolving the final URL.",
  "id": "GHSA-f359-r3pv-2phf",
  "modified": "2026-04-08T23:15:59Z",
  "published": "2026-03-26T18:10:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints"
}

GHSA-F3C6-J4CC-HQC4

Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49

Details

A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-29145"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-29T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.",
  "id": "GHSA-f3c6-j4cc-hqc4",
  "modified": "2022-05-24T17:49:13Z",
  "published": "2022-05-24T17:49:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29145"
    },
    {
      "type": "WEB",
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-009.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-F3QM-VFC3-JG6V

Vulnerability from github – Published: 2024-02-20 18:03 – Updated: 2024-02-20 22:34

Summary

Possible CSRF attack at questionnaire templates preview

Details

Impact

The CSRF authenticity token check is currently disabled for the questionnaire templates preview as per: https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11

This was introduced by this commit in the PR that introduced this feature (#6247): https://github.com/decidim/decidim/pull/6247/commits/5542227be66e3b6d7530f5b536069bce09376660

The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public.

Patches

11743

Workarounds

Disable the templates functionality or remove all available templates.

References

11743

Severity

4.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim-templates"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.27.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-47635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-20T18:03:12Z",
    "nvd_published_at": "2024-02-20T18:15:50Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe CSRF authenticity token check is currently disabled for the questionnaire templates preview as per:\nhttps://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11\n\nThis was introduced by this commit in the PR that introduced this feature (#6247):\nhttps://github.com/decidim/decidim/pull/6247/commits/5542227be66e3b6d7530f5b536069bce09376660\n\nThe issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public.\n\n### Patches\n#11743\n\n### Workarounds\nDisable the templates functionality or remove all available templates.\n\n### References\n#11743",
  "id": "GHSA-f3qm-vfc3-jg6v",
  "modified": "2024-02-20T22:34:19Z",
  "published": "2024-02-20T18:03:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-f3qm-vfc3-jg6v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/pull/11743"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/pull/6247"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce09376660"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/commit/57a4b467787448307b5d9b01ce6e2c8502e121ac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decidim/decidim"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/releases/tag/v0.27.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/releases/tag/v0.28.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Possible CSRF attack at questionnaire templates preview"
}

CWE-918

Server-Side Request Forgery (SSRF)

GHSA-F28J-GX5R-P78J

GHSA-F2C6-8JG6-287F

GHSA-F2CG-3CWW-MCQ8

GHSA-F2F4-JWFQ-4Q5V

GHSA-F2G2-3GV9-7Q7G

GHSA-F2RJ-M42R-6JM2

Impact

Patches

Workarounds

References

For more information

GHSA-F2W4-MP23-HR7Q

GHSA-F359-R3PV-2PHF

Summary

Root Cause

Proof of Concept

Impact

Note

Suggested Fix

GHSA-F3C6-J4CC-HQC4

GHSA-F3QM-VFC3-JG6V

Impact

Patches

11743

Workarounds

References

11743

CAPEC-664: Server Side Request Forgery