CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- openwebui open webui, open-webui +1 moreOpen WebUI: Blind server side request forgery (SSRF) via the PDF generate function4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)7.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Full SSRF Vulnerability in the RAG Web Search Feature8.5 High
- apostrophecms apostropheApostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget7.6 High
@karakeep/sdknpmKarakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections7.1 High- nextcloud newsNextcloud News: Authenticated blind SSRF via feed URL2.3 Low
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter7.5 High
- gitlabServer-Side Request Forgery (SSRF) in GitLab3.5 Low
- frappe erpnextERPNext: Possible SSRF by any authenticated user5.0 Medium
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address5.9 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 more +4 morePAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching4.8 Medium
- nautobotNautobot: Webhook definitions could be used for server-side request forgery (SSRF)8.5 High
- sillytavernSillyTavern: SSRF vulnerability in the CORS proxy middleware6.9 Medium
- mosparomosparo: Rule package source URL stored SSRF enables internal HTTP probing5.0 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)7.4 High
- xibosignage xibo-cmsXibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality7.7 High
- dragonmonk111 junoclawJunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access8.2 High
- artica pandora fms, pandora fms fms +1 moreServer-Side Request Forgery in API Checker leads to Privilege Escalation7.1 High
- learningcircuit local-deep-researchLocal Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)5.0 Medium
- jishenghua jsherpjishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery5.1 Medium
- openedx, openedx openedx-platform +1 moreOpen edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint8.5 High
- sonatype nexus repository, nexus repository manager +1 moreNexus Repository 3 - Improper LDAP Referral Handling5.1 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreServer-Side Request Forgery (SSRF) in mlflow/mlflow7.1 High
- budibaseBudibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)7.7 High
- datadog guarddogGuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration8.2 High
- gotenbergGotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass8.6 High
- No product listedAkaunting Invoice PDF Rendering dompdf.php server-side request forgery5.3 Medium
- linkwardenLinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function9.1 Critical
- gitroomhq postiz-appPostiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths6.5 Medium
- labring fastgptFastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation2.3 Low
- labring fastgptFastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution6.3 Medium
- labring fastgptFastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot7.7 High
- anzory solidcam-gppl-ideSolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak5.1 Medium
- bugsinkBugsink: SSRF bypass in `validate_webhook_url`4.3 Medium
- lfprojects mcp registry, modelcontextprotocol registry +1 moreMCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist6.3 Medium
- lfprojects mcp registry, modelcontextprotocol registry +1 moreMCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience2.1 Low
n8n-mcpnpmn8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure8.3 High- czlonkowski n8n-mcpn8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths7.2 High
- legeling prompthubPromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote`7.1 High
- universal-tool-calling-protocol python-utcppython-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol4.7 Medium
- lin-snow ech0Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo8.3 High
- github enterprise serverServer-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion7.9 High
- microsoft azure monitor action group notification systemAzure Monitor Action Group Notification System Elevation of Privilege Vulnerability8.1 High
- nuxt-modules og-imagenuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)3.7 Low
- freescout-help-desk freescoutFreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access7.7 High
- router-for-me cliproxyapirouter-for-me CLIProxyAPI api_tools.go server-side request forgery5.3 Medium
- ellite wallosWallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services6.0 Medium
- ellite wallosIncomplete fix for CVE-2026-33399: SSRF in Wallos7.7 High
- ellite wallosWallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks4.3 Medium
- docling-project docling-graphDocling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler5.7 Medium
- Show moreLoading…