CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- frappe erpnext, frappe +1 moreA Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of...9.1 Critical
- qd-today qdQD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request9.1 Critical
- wwbn avideoWWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)7.1 High
- wwbn avideoWWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services6.5 Medium
- openobserveOpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url7.7 High
- openclawOpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect4.8 Medium
- churchcrm, churchcrm crm +1 moreSSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts7.0 High
- kovah linkaceLinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection5.0 Medium
- oobabooga text-generation-webui, text generation web ui +1 moretext-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation7.5 High
- papraPapra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL5.0 Medium
- ays-pro popup boxPopup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF5.4 Medium
- pavelzbornik whisperx rest api, whisperx-fastapi +1 morewhisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp35.8 Medium
- distributionDistribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm7.5 High
- assafelovic gpt-researcherassafelovic gpt-researcher ws Endpoint server-side request forgery6.9 Medium
- hcengineering huly platformhcengineering Huly Platform Import Endpoint index.ts server-side request forgery5.3 Medium
- kalcaddle kodboxkalcaddle kodbox shareMake/shareCheck server-side request forgery6.3 Medium
- imprvhub mcp-browser-agentimprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery5.3 Medium
- qingdaou onlinejudgeQingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery5.3 Medium
- ollamaOllama Model Pull API download.go server-side request forgery5.3 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad has SSRF fix bypass via HTTP redirect9.3 Critical
- apeworx web3.pyweb3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling1.7 Low
- ethereum web3.pyWeb3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass6.3 Medium
- directusDirectus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import7.7 High
- pyload, pyload-ng project pyload-ng +1 morepyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter7.7 High
- vllmvLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `5.4 Medium
- lexiforest curl cffiRedirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)8.6 High
- f prompts.chatprompts.chat SSRF via Fal.ai Media Status Polling7.1 High
- f prompts.chatprompts.chat Blind SSRF via media-generate5.3 Medium
- icewhaletech zimaosArbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS9.1 Critical
- microsoft bingMicrosoft Bing Elevation of Privilege Vulnerability10.0 Critical
- budibaseBudibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist9.6 Critical
- mixelpixx google-research-mcpmixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery5.3 Medium
- casbin casdoorCasdoor Webhook URL server-side request forgery5.1 Medium
- bulwarkmail webmailRoundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages5.4 Medium
- ech0Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata7.2 High
- ech0Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature7.5 High
- microsoft azure custom locations resource providerAzure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability9.6 Critical
- microsoft azure databricksAzure Databricks Elevation of Privilege Vulnerability10.0 Critical
- openclawOpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download4.8 Medium
- appsmithorg appsmithappsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery6.9 Medium
- dataease sqlbotDataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery5.1 Medium
- gitroom postiz, gitroomhq postiz-app +1 morePostiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation5.4 Medium
- gitroom postiz, gitroomhq postiz-app +1 morePostiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check8.6 High
- gitroom postiz, gitroomhq postiz-app +1 morePostiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata8.3 High
- huimeicloud hm editorhuimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery6.9 Medium
- pfefferle webmentionWebmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery7.2 High
- pfefferle webmentionWebmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
- priyankark a11y-mcppriyankark a11y-mcp index.js A11yServer server-side request forgery4.8 Medium
- mervinpraison praisonai, praison praisonaiagents +1 morePraisonAI: SSRF in FileTools.download_file() via Unvalidated URL8.6 High
- mervinpraison praisonaiPraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback7.7 High
- Show moreLoading…