CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- addonspress advanced importAdvanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter6.4 Medium
- bitpressadmin bit integrations – form integration, webhook, spreadsheets, crm, lms & email automationBit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping6.5 Medium
- signalk signalk-serverSignal K Server: Server-Side Request Forgery via Remote Connection Endpoints5.8 Medium
- kidocode crawl4aiCrawl4AI unauthenticated SSRF in Docker streaming crawl endpoint8.6 High
- nodemailernodemailer before 9.0.1 File Read and SSRF via raw option7.1 High
- mervinpraison praisonaiagentsPraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter8.8 High
- mervinpraison praisonaiPraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding7.2 High
- mervinpraison praisonaipraisonaiagents: SSRF guard validates literal IPs only and never resolves DNS8.5 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SpiderTools redirect-target SSRF protection bypass6.5 Medium
- gotenbergGotenberg: SSRF via LibreOffice document processing7.5 High
- zitadelZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components2.3 Low
- mariovalney cf7 to webhookCF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host7.2 High
- baptistearno typebot.ioTypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass8.2 High
- black lantern security bbotSSRF via unvalidated WWW-Authenticate realm in docker_pull module3.1 Low
- drupal, drupal core +1 moreDrupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-0083.1 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects7.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal7.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`8.5 High
- nocodbNocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint6.9 Medium
- nocodbNocoDB: Server-Side Request Forgery via Base Migration URL5.1 Medium
- nocodbNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL5.1 Medium
- pydantic pydantic-ai, ai, pydantic-ai-slim +2 morepydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)6.8 Medium
- kidocode crawl4aiCrawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check8.6 High
- crawl4aiCrawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution8.8 High
- kidocode crawl4aiCrawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)7.5 High
- lobehubLobeHub: Unauthenticated SSRF in `/webapi/proxy`9.0 Critical
- crawl4aiCrawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints9.2 Critical
- crawl4aiCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key9.3 Critical
- crawl4aiCrawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint9.2 Critical
- crawl4aiCrawl4AI - Stored Cross-Site Scripting in Monitor Dashboard5.3 Medium
- crawl4aiCrawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server6.9 Medium
- crawl4aiCrawl4AI - Server-Side Request Forgery via Webhook URLs9.2 Critical
- crawl4aiCrawl4AI - Arbitrary File Write via output_path Parameter8.8 High
- gohugo hugoHugo: security.http.urls allow-list bypass via HTTP redirects6.3 Medium
- denoDeno: WebSocket API sandbox bypass via missing post-DNS check5.2 Medium
- denoDeno: `fetch()` API sandbox bypass via missing DNS resolution check5.2 Medium
- openclawOpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency6.0 Medium
- phpseclibphpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access5.8 Medium
- astroAstro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)7.5 High
- withastro astro@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config5.3 Medium
- alobaidi popadWordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability4.4 Medium
- encode starlette, red hat exploit intelligence, migration toolkit for applications 8 +8 more +10 moreStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows7.5 High
- sensiolabs symfony, actions http-client, symfony http-foundation +2 moreSymfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient6.9 Medium
- angularAngular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass8.8 High
- universal-tool-calling-protocol python-utcpuniversal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery5.3 Medium
koillection/koillectionPackagistKoillection has an authenticated Server-Side Request Forgery issue8.1 Highshlinkio/shlinkPackagistshlink has a Server-Side Request Forgery issue9.1 Critical- openclawOpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding6.0 Medium
- apostrophecms apostrophe@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header3.7 Low
- koelKoel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail6.3 Medium
- Show moreLoading…