CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- sillytavernSillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv65.0 Medium
- aio-libs aiohttpAIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows6.6 Medium
- payloadcms payloadPayload has Authenticated SSRF via Upload Functionality7.7 High
- cisco nexus dashboard, nexus dashboard insights +1 moreCisco Nexus Dashboard Server Side Request Forgery Vulnerability6.1 Medium
- devolutions serverImproper input validation in the gateway health check feature in Devolutions Server allows a low...4.3 Medium
- m-files serverBlind server-side request forgery (SSRF) vulnerability in legacy connection methods of document...6.9 Medium
- autohomecorp frostmourneAutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery5.3 Medium
- openclawOpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Ranges5.1 Medium
nuxt-og-imagenpmNuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters5.3 Medium- jlowin fastmcp, red hat openshift ai (rhoai), satellite 6.18 +2 moreFastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability10.0 Critical
- freescoutFreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()6.9 Medium
- wwbn avideoAVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation6.5 Medium
- invoiceshelfInvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field7.6 High
- invoiceshelfInvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field7.6 High
- invoiceshelfInvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field7.6 High
- discourseDiscourse: Group SMTP test endpoint susceptible to SSRF5.3 Medium
- No product listedchatwoot Webhook API trigger.rb Trigger server-side request forgery5.3 Medium
- openclawOpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider6.9 Medium
- fastgptFastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft10.0 Critical
- fastgptServer-Side Request Forgery via MCP Tools Endpoint in FastGPT7.7 High
- unknown performance monitorPerformance Monitor <= 1.0.6 - Unauthenticated Blind SSRF5.8 Medium
- openstack glance, red hat openstack platform 16.2, openstack platform 17.1 +1 more +3 moreOpenStack Glance is affected by Server-Side Request Forgery (SSRF)5.0 Medium
- kyvernoCVE-2026-47899.8 Critical
- tautulliTautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server4.0 Medium
- sourcecodester rss feed parserSourceCodester RSS Feed Parser file_get_contents server-side request forgery5.3 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing5.8 Medium
- docker model runner, model-runner +1 moreDocker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)6.8 Medium
- gotenbergGotenberg: Chromium deny-list bypass via case-insensitive URL scheme7.8 High
- crewaiCVE-2026-22869.8 Critical
- cloudark kubeplusIn KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF...7.6 High
- invoiceninja invoice ninjaInvoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in...7.7 High
- lollms, parisneo parisneo/lollms +1 moreServer-Side Request Forgery (SSRF) in parisneo/lollms7.5 High
- openclawOpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel Extensions5.3 Medium
- elecv2 elecv2pelecV2 elecV2P URL mock eAxios server-side request forgery6.9 Medium
- laborator oxygen - woocommerce wordpress themeOxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path7.2 High
- kovah linkaceLinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce8.5 High
- clerk javascriptClerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host7.4 High
- danny-avila librechatLibreChat Server-Side Request Forgery using DNS resolution7.7 High
- danny-avila librechatLibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP8.5 High
- pyloadpyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration9.3 Critical
- lettaletta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery5.3 Medium
postiznpmPostiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader7.8 HighpostiznpmPostiz App has a High-Severity SSRF Vulnerability via Next.js7.5 High- mingsoft mcmsmingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery6.9 Medium
- calibre-ebook calibrecalibre has Server-Side Request Forgery in ebook viewer backend4.8 Medium
- spring ai, vmware spring ai +1 moreServer-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching8.6 High
- page-replica page replicaPage-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery5.3 Medium
- otcmsServer-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read...7.5 High
- lycheeorg lycheeLychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs2.3 Low
- lycheeorg lycheeLychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked5.3 Medium
- Show moreLoading…