Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
RAGAS has an Arbitrary File Read vulnerability
- Path traversal
- Denial of service
>=0.2.3, <0.3.0-rc1 · fixed in 0.3.0-rc1
GHSA-v2xr-wvrv-p969 · CVE-2025-45691 - CVSS 5.0 Medium
Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client
- twenty
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability
- SkatDesign Ratatouille
- Server-side request forgery (SSRF)
- CVSS 7.8 High
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
- Server-side request forgery (SSRF)
- CWE-706
<1.17.1 · fixed in 1.17.1
GHSA-c7mq-gh6q-6q7c · CVE-2025-6087 - CVSS 7.7 High
Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint
- Server-side request forgery (SSRF)
<0.19.16 · fixed in 0.19.16
GHSA-jvxv-2jjp-jxc3 · CVE-2026-29178 - CVSS 2.3 Low
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
- Server-side request forgery (SSRF)
<2026.2.22 · fixed in 2026.2.22
GHSA-4rqq-w8v4-7p47 · CVE-2026-32019 - CVSS 4.0, no score published
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
- Server-side request forgery (SSRF)
>=2026.1.20, <2026.2.19 · fixed in 2026.2.19
GHSA-8cp7-rp8r-mg77 - CVSS 7.2 High
PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
- wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
HomeBox affected by Blind SSRF
- sysadminsmedia homebox
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model
- Race condition
- Server-side request forgery (SSRF)
<2026.2.26 · fixed in 2026.2.26
GHSA-7qf6-h84j-8fq4 - CVSS 4.0, no score published
OpenClaw has a IPv6 multicast SSRF classifier bypass
- Server-side request forgery (SSRF)
<2026.2.25 · fixed in 2026.2.25
GHSA-h97f-6pqj-q452 - CVSS 6.1 Medium
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured
- Race condition
- Server-side request forgery (SSRF)
<2026.3.2 · fixed in 2026.3.2
GHSA-8mvx-p2r9-r375 · CVE-2026-22181 - CVSS 5.5 Medium
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
- Server-side request forgery (SSRF)
>=2026.2.13, <2026.3.2 · fixed in 2026.3.2
GHSA-2858-xg23-26fp - CVSS 2.3 Low
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
- Server-side request forgery (SSRF)
<2026.2.22 · fixed in 2026.2.22
GHSA-w76h-8m22-hpgh · CVE-2026-32037 - CVSS 4.3 Medium
`melange update-cache` has unbounded HTTP download that can exhaust disk in CI
- Denial of service
- Server-side request forgery (SSRF)
<0.43.4 · fixed in 0.43.4
GHSA-7rp8-r62p-q6wc · CVE-2026-29049 - CVSS 5.3 Medium
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
- Server-side request forgery (SSRF)
<2026.3.1 · fixed in 2026.3.1
GHSA-g99v-8hwm-g76g · CVE-2026-31989 - CVSS 9.2 CriticalCritical · CVSS 9+
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
- Server-side request forgery (SSRF)
<1.6.4 · fixed in 1.6.4
GHSA-fcrh-fqxh-6fx6 · CVE-2026-28508 - CVSS 7.1 High
ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
- IceWhaleTech ZimaOS
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Chamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)
- chamilo-lms
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Chamilo: Potential unauthenticated blind SSRF via openid function
- chamilo-lms
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Statamic Vulnerable to Server-Side Request Forgery via Glide
- Server-side request forgery (SSRF)
<5.73.11 || >=6.0.0-alpha.1, <6.4.0 · fixed in 5.73.11, 6.4.0
GHSA-cwpp-325q-2cvp · CVE-2026-28423 - CVSS 8.2 High
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
- Server-side request forgery (SSRF)
<6.6.0 · fixed in 6.6.0
GHSA-jmh7-g254-2cq9 · CVE-2026-28416 - CVSS 5.3 Medium
Featured Image from Content < 1.7 Authenticated SSRF via save_post
- Dhrumil Kumbhani Featured Image from Content
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)
- kiteworks security-advisories
- Server-side request forgery (SSRF)
- CWE-350
- CVSS 7.5 High
XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)
- Xerox FreeFlow Core
- XML external entities (XXE)
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
itwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgery
- itwanger paicoding
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
PSI Probe vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=5.3.0 · no fixed version yet
GHSA-429m-9874-rx9w · CVE-2026-3270 - CVSS 4.3 Medium
Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Server-side request forgery (SSRF)
- CVSS 8.7 High
TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist
- Server-side request forgery (SSRF)
- CWE-20
<4.0.3 · fixed in 4.0.3
GHSA-w789-49fc-v8hr · CVE-2026-27818 - CVSS 5.8 Medium
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API
- Server-side request forgery (SSRF)
<1.29.2 · fixed in 1.29.2
GHSA-mpf7-p9x7-96r3 · CVE-2026-27808 - CVSS 4.1 Medium
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
- Server-side request forgery (SSRF)
<1.1.18 · fixed in 1.1.18
GHSA-mphv-75cg-56wg · CVE-2026-27795 - CVSS 8.6 High
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
- Server-side request forgery (SSRF)
<0.0.0-20250616164159-0593516c4cfa · fixed in 0.0.0-20250616164159-0593516c4cfa
GHSA-p2v6-84h2-5x4r · CVE-2026-27730 - CVSS 9.2 CriticalCritical · CVSS 9+
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
- Server-side request forgery (SSRF)
<19.2.21 || >=20.0.0-next.0, <20.3.17 || >=21.0.0-next.0, <21.1.5 || >=21.2.0-next.0, <21.2.0-rc.1 · fixed in 19.2.21, 20.3.17, 21.1.5, 21.2.0-rc.1
GHSA-x288-3778-4hhx · CVE-2026-27739 - CVSS 8.6 High
changedetection.io is Vulnerable to SSRF via Watch URLs
- Server-side request forgery (SSRF)
<0.54.1 · fixed in 0.54.1
GHSA-3c45-4pj5-ch7m · CVE-2026-27696 - CVSS 8.6 High
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
- Server-side request forgery (SSRF)
<22.0 · fixed in 22.0
GHSA-h39h-7cvg-q7j6 · CVE-2026-27732 - CVSS 0.0 None
OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field
- Server-side request forgery (SSRF)
<1.7.5 || >=1.8.0, <1.8.3 · fixed in 1.7.5, 1.8.3
GHSA-9fj4-3849-rv9g · CVE-2026-24005 - CVSS 6.5 Medium
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
- Server-side request forgery (SSRF)
>=9.0.0, <9.5.4 · fixed in 9.5.4
GHSA-cj9f-h6r6-4cx2 · CVE-2026-27829 - CVSS 2.3 Low
feiyuchuixue sz-boot-parent download server-side request forgery
- feiyuchuixue sz-boot-parent
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
- plane
- Server-side request forgery (SSRF)
- CVSS 8.7 High
esm.sh is vulnerable to full-response SSRF
- Server-side request forgery (SSRF)
<0.0.0-20250616164159-0593516c4cfa · fixed in 0.0.0-20250616164159-0593516c4cfa
GHSA-3c9r-837r-qqm4 · CVE-2025-50180 - CVSS 5.0 Medium
Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload
- dfactory Responsive Lightbox & Gallery
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SourceCodester Website Link Extractor URL file_get_contents server-side request forgery
- SourceCodester Website Link Extractor
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
- Server-side request forgery (SSRF)
<3.75.0 · fixed in 3.75.0
GHSA-hhfx-5x8j-f5f6 · CVE-2026-27567 - CVSS 4.6 Medium
Mastodon has SSRF via unvalidated FASP Provider base_url
- mastodon
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE
- Beyond Limits Inc. Altec DocLink
- Insecure deserialization
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- Server-side request forgery (SSRF)
>=3.5.0, <4.16.19 || >=5.0.0-RC1, <5.8.23 · fixed in 4.16.19, 5.8.23
GHSA-v2gc-rm6g-wrw9 · CVE-2026-27129 - CVSS 5.3 Medium
DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery
- DataLinkDC dinky
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Astro has Full-Read SSRF in error rendering via Host: header injection
- Server-side request forgery (SSRF)
<9.5.4 · fixed in 9.5.4
GHSA-qq67-mvv5-fw3g · CVE-2026-25545 - CVSS 6.9 Medium
erzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgery
- erzhongxmu JEEWMS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Tiandy Video Surveillance System 视频监控平台 CLSBODownLoad.java downloadImage server-side request forgery
- Tiandy Video Surveillance System 视频监控平台
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
JeecgBoot uploadImgByHttp server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 7.1 High
OpenSift: SSRF risk in URL ingestion endpoint
- OpenSift
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 5.3 Medium
phpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.php
- phpMoAdmin
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
OpenClaw hardened cron webhook delivery against SSRF
- Server-side request forgery (SSRF)
<2026.2.19 · fixed in 2026.2.19
GHSA-w45g-5746-x9fp · CVE-2026-27488 - CVSS 7.2 High
WordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability
- Laborator Oxygen
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SSRF vulnerability have been discovered in OpenText™ XM Fax
- OpenText™ XM Fax
- Server-side request forgery (SSRF)
- CVSS 7.1 High
SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services
- SillyTavern
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Hyland Alfresco Transformation Service Argument Injection RCE
- Hyland Alfresco Transformation Service (Enterprise)
- Hyland Alfresco Community (Transform Core)
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Hyland Alfresco Transformation Service SSRF
- Hyland Alfresco Transformation Service (Enterprise)
- Hyland Alfresco Community (Transform Core)
- Server-side request forgery (SSRF)