CVE-2026-49345
Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (/admin/config/parameters). The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the Mercator server to issue arbitrary outbound network requests. The suffix /api/dbInfo appended to the URL can be bypassed by injecting a # fragment character (e.g. http://TARGET/PATH#), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The telnet:// scheme can be used for internal port scanning; the gopher:// scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (/admin/config/parameters). The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the Mercator server to issue arbitrary outbound network requests. The suffix /api/dbInfo appended to the URL can be bypassed by injecting a # fragment character (e.g. http://TARGET/PATH#), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The telnet:// scheme can be used for internal port scanning; the gopher:// scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
- Record
CVE-2026-49345- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-38072
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (/admin/config/parameters). The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the Mercator server to issue arbitrary outbound network requests. The suffix /api/dbInfo appended to the URL can be bypassed by injecting a # fragment character (e.g. http://TARGET/PATH#), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The telnet:// scheme can be used for internal port scanning; the gopher:// scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
- Record
EUVD-2026-38072- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
NVD
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (/admin/config/parameters). The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the Mercator server to issue arbitrary outbound network requests. The suffix /api/dbInfo appended to the URL can be bypassed by injecting a # fragment character (e.g. http://TARGET/PATH#), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The telnet:// scheme can be used for internal port scanning; the gopher:// scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
- Record
CVE-2026-49345- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49345 is a medium vulnerability (CVSS 5.3) in Dbarzin Mercator, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. No source names a fixed version.