CVE-2017-18638
graphite.composer.views.send_email vulnerable to SSRF
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
CVE-2017-18638- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
CVE-2017-18638- Updated
- 2026-11-02
EUVDEUVD-2019-0058 No score
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
EUVD-2019-0058- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vfj6-275q-4pvm
graphite.composer.views.send_email vulnerable to SSRF
Impact
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. Email will be send through SMTP server configured in Graphite, by default it's 'localhost'
Patches
Problem was patched in Graphite-web 1.1.6. Also patches was released for graphite-web 1.0.x and 0.9.x, and we'll discuss releases of non-supported branches later.
Workarounds
You can manually remove function send_email from file webapp/graphite/composer/views.py. This function are not in use and will not affect your Graphite installation.
References
For more information check this graphite-web Github issue #2008
For more information
If you have any questions or comments about this advisory:
- Add comment in issue #2008
- Record
GHSA-vfj6-275q-4pvm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
CVE-2017-18638- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-18638
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
DEBIAN-CVE-2017-18638- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-vfj6-275q-4pvm
graphite.composer.views.send_email vulnerable to SSRF
Impact
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. Email will be send through SMTP server configured in Graphite, by default it's 'localhost'
Patches
Problem was patched in Graphite-web 1.1.6. Also patches was released for graphite-web 1.0.x and 0.9.x, and we'll discuss releases of non-supported branches later.
Workarounds
You can manually remove function send_email from file webapp/graphite/composer/views.py. This function are not in use and will not affect your Graphite installation.
References
For more information check this graphite-web Github issue #2008
For more information
If you have any questions or comments about this advisory:
- Add comment in issue #2008
- Record
GHSA-vfj6-275q-4pvm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-18638
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
UBUNTU-CVE-2017-18638- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVPYSEC-2019-151 No score
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
- Record
PYSEC-2019-151- Updated
- 2026-11-02
OSVSUSE-SU-2019:2803-1 No score
Security update for graphite-web
This update for graphite-web fixes the following issues:
- CVE-2017-18638: Fixed an SSRF vulnerability in send_email (bsc#1154007).
- Record
SUSE-SU-2019:2803-1- Updated
- 2026-11-02
OSVUSN-6243-1 No score
graphite-web vulnerabilities
It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)
It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. (CVE-2022-4728, CVE-2022-4729, CVE-2022-4730)
- Record
USN-6243-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphite-webPyPI |
before 1.1.6 | 1.1.6 |
graphite-webDebian:12 |
before 1.1.4-5 | 1.1.4-5 |
graphite-webDebian:13 |
before 1.1.4-5 | 1.1.4-5 |
graphite-webDebian:14 |
before 1.1.4-5 | 1.1.4-5 |
graphite-webDebian:8 |
before 0.9.12+debian-6+deb8u1 | 0.9.12+debian-6+deb8u1 |
graphite-webPyPI |
before 1.1.6, plus listed versions 0.9.100.9.110.9.120.9.130.9.14 Show 18 moreShow less0.9.150.9.160.9.50.9.60.9.70.9.7b0.9.7c0.9.80.9.91.0.01.0.11.0.21.1.01.1.11.1.21.1.31.1.41.1.5 |
1.1.6 |
graphite-webSUSE:Enterprise Storage 4 |
before 0.9.12-5.3.1 | 0.9.12-5.3.1 |
graphite-webUbuntu:Pro:14.04:LTS |
before 0.9.12+debian-3ubuntu0.1~esm1, plus listed versions 0.9.12+debian-10.9.12+debian-20.9.12+debian-3 |
0.9.12+debian-3ubuntu0.1~esm1 |
graphite-webUbuntu:Pro:16.04:LTS |
before 0.9.15+debian-1ubuntu0.1~esm1, plus listed versions 0.9.13+debian-10.9.15+debian-1 |
0.9.15+debian-1ubuntu0.1~esm1 |
graphite-webUbuntu:Pro:18.04:LTS |
before 1.0.2+debian-2ubuntu0.1~esm1, plus listed versions 0.9.15+debian-21.0.2+debian-2 |
1.0.2+debian-2ubuntu0.1~esm1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
graphite-webUbuntu:Pro:14.04:LTS From an advisory covering 4 CVEs |
before 0.9.12+debian-3ubuntu0.1~esm2, plus listed versions 0.9.12+debian-10.9.12+debian-20.9.12+debian-30.9.12+debian-3ubuntu0.1~esm1 |
0.9.12+debian-3ubuntu0.1~esm2 |
graphite-webUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 0.9.15+debian-1ubuntu0.1~esm1, plus listed versions 0.9.13+debian-10.9.15+debian-1 |
0.9.15+debian-1ubuntu0.1~esm1 |
graphite-webUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 1.0.2+debian-2ubuntu0.1~esm1, plus listed versions 0.9.15+debian-21.0.2+debian-2 |
1.0.2+debian-2ubuntu0.1~esm1 |
graphite-webUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 1.1.4-5ubuntu0.1, plus listed versions 1.1.4-31.1.4-5 |
1.1.4-5ubuntu0.1 |
graphite-webUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 1.1.8-1ubuntu0.22.04.1, plus listed versions 1.1.4-51.1.8-1 |
1.1.8-1ubuntu0.22.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Graphite <=1.1.5 - Server-Side Request Forgery |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-18638 is a high vulnerability (CVSS 7.5) in Graphite Project Graphite, published October 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.3%, the 96th percentile. Fixed in graphite-web 1.1.6.
References
github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html
youtube.com/watch?v=ds4Gp4xoaeA
lists.debian.org/debian-lts-announce/2019/10/msg00030.html
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-18638
security-tracker.debian.org/tracker/CVE-2017-18638
suse.com/support/update/announcement/2019/suse-su-20192803-1
bugzilla.suse.com/1154007
ubuntu.com/security/CVE-2017-18638
cve.org/CVERecord?id=CVE-2017-18638