CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- bufanyun hotgobufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery5.3 Medium
- welovemedia ffmatewelovemedia FFmate webhook.go fireWebhook server-side request forgery5.3 Medium
- homarrHomarr: Unauthenticated SSRF in rssFeed.ts5.3 Medium
- ellite wallosWallos: Server-Side Request Forgery (SSRF) in Notification Testers8.8 High
- ellite wallosWallos: SSRF via webhook test endpoint5.3 Medium
- ellite wallosWallos: SSRF via url parameter leading to File Traversal8.7 High
- tencent weknoraWeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources6.5 Medium
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve: SSRF via unvalidated LFS endpoint in repo import9.1 Critical
- wekanWekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading9.3 Critical
- pinchtabPinchTab: SSRF with Full Response Exfiltration via Download Handler7.5 High
- ghostfol ghostfolioGhostfolio: Full-Read SSRF in Manual Asset Import9.3 Critical
- opensiftOpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access8.2 High
- tencent weknoraWeKnora: SSRF via Redirection5.9 Medium
- makeplane planePlane: SSRF via Incomplete IP Validation in Webhook URL Serializer8.5 High
- twentyTwenty: SSRF protection bypass via HTTP redirect following in secure HTTP client5.0 Medium
- skatdesign ratatouilleWordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- vibrantlabsai ragas, red hat openshift ai (rhoai) +1 moreRAGAS has an Arbitrary File Read vulnerability7.5 High
- lemmynet lemmyLemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint7.7 High
- openclawOpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard2.3 Low
openclawnpmOpenClaw has SSRF guard bypass via IPv6 transition over ISATAP6.9 Medium- drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 moreOpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-0254.3 Medium
- wpxpo post grid gutenberg blocks for news, magazines, blog websites – postxPostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints7.2 High
- sysadminsmedia homeboxHomeBox affected by Blind SSRF5.0 Medium
openclawnpmOpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model2.3 LowopenclawnpmOpenClaw has a IPv6 multicast SSRF classifier bypass6.3 Medium- openclawOpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch6.1 Medium
openclawnpmOpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots5.5 Medium- openclawOpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling2.3 Low
- chainguard melangemelange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI4.3 Medium
- openclawOpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect5.3 Medium
- idno, withknown known +1 moreIdno: Unauthenticated SSRF via URL Unfurl Endpoint9.2 Critical
- icewhaletech zimaosZimaOS is vulnerable to Server-Side Request Forgery (SSRF)7.1 High
- chamilo chamilo-lms, lms +1 moreChamilo: Blind Server-Side Request Forgery (Unauth Blind SSRF)7.7 High
- chamilo chamilo-lms, lms +1 moreChamilo: Potential unauthenticated blind SSRF via openid function5.3 Medium
- dhrumil kumbhani featured image from contentFeatured Image from Content < 1.7 Authenticated SSRF via save_post5.3 Medium
- statamic cms, statamic +1 moreStatamic Vulnerable to Server-Side Request Forgery via Glide6.8 Medium
- gradio-app gradioGradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing8.2 High
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)6.5 Medium
- xerox freeflow coreXML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)7.5 High
- itwanger paicodingitwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgery5.3 Medium
- psi-probe psi probepsi-probe PSI Probe Whois Whois.java lookup server-side request forgery5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGvfs: gvfs ftp backend: information disclosure via untrusted pasv responses4.3 Medium
- zitadelZITADEL has potential SSRF via Actions2.1 Low
- terria terriajs-serverTerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist8.7 High
- axllent mailpitMailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API5.8 Medium
- drupal canvasDrupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-0175.0 Medium
- openkruise kruiseOpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field0.0 None
- withastro astro, astro \@astrojs\/node +1 moreAstro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize6.5 Medium
- langchain community, langchain-ai langchainjs +1 moreLangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader4.1 Medium
- angular @nguniversal/common, @nguniversal/express-engine, angular-cli +2 moreAngular SSR is vulnerable to SSRF and Header Injection via request handling pipeline9.2 Critical
- Show moreLoading…