cve.bz

CWE-918: Server-Side Request Forgery (SSRF), page 22

Filter

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

What the weakness is: CWE-918 at MITRE

Ask an AI about CWE-918

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-918: Server-Side Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/918.html and https://cve.bz/cve/cwe/918?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.5CVE-2026-67424EPSS 0.3%

    Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/cor…

  2. 8.6CVE-2026-16328EPSS 0.4%

    In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious …

  3. 10.0CVE-2026-54735EPSS 0.6%

    Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without prop…

  4. 6.1CVE-2026-54663EPSS 0.2%

    swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl…

  5. 7.4CVE-2026-54660EPSS 0.3%

    swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDo…

  6. 4.9CVE-2026-6089EPSS 0.5%

    The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-…

  7. 8.2CVE-2026-58189EPSS 0.6%

    Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10…

  8. 7.5CVE-2026-55391EPSS 0.3%

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL hos…

  9. 8.2CVE-2026-54691EPSS 0.3%

    datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowin…

  10. 8.2CVE-2026-54690EPSS 0.4%

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently de…

  11. 4.1CVE-2026-4912EPSS 0.4%

    The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` …

  12. 8.6CVE-2026-14869EPSS 0.4%

    The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the se…

  13. 7.7CVE-2026-59931EPSS 0.5%

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE()…

  14. 7.2CVE-2026-54605EPSS 0.2%

    OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follow…

  15. 8.2CVE-2026-43910EPSS 0.4%

    Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directCon…

  16. 5.1CVE-2026-67173EPSS 0.4%

    Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victi…

  17. 7.2CVE-2026-65442ExploitEPSS 0.6%

    Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.

  18. 7.2CVE-2026-61953EPSS 0.3%

    Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.

  19. 6.5CVE-2026-65925EPSS 0.4%

    A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

  20. 6.5CVE-2026-65924EPSS 0.4%

    JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could ca…

  21. 6.8CVE-2026-65923EPSS 0.3%

    A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity…

  22. 6.5CVE-2026-65618EPSS 0.4%

    Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

  23. 8.3CVE-2026-64649EPSS 0.5%

    Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbo…

  24. 6.0CVE-2026-16481EPSS 0.2%

    A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HT…

  25. 8.3CVE-2026-64645EPSS 0.4%

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled i…

  26. 6.9CVE-2026-54272EPSS 0.4%

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies …

  27. 3.5CVE-2026-48051EPSS 0.3%

    Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make H…

  28. 9.1CVE-2026-17552EPSS 0.5%

    Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path…

  29. 6.3CVE-2026-17192EPSS 0.3%

    A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role …

  30. 4.9CVE-2026-66437EPSS 0.2%

    Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

  31. 5.4CVE-2026-65558EPSS 0.2%

    Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

  32. 7.2CVE-2026-59552EPSS 0.3%

    Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1.4.2 versions.

  33. 5.5CVE-2026-17534EPSS 0.2%

    Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who c…

  34. 8.6CVE-2025-15662EPSS 0.4%

    The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attac…

  35. 2.1CVE-2026-17458EPSS 0.4%

    A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-s…

  36. 10.0CVE-2026-57106EPSS 0.9%

    Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

  37. 5.5CVE-2026-16910EPSS 0.3%

    A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST …

  38. 8.8CVE-2026-16870EPSS 1.3%

    Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execut…

  39. 8.8CVE-2026-56167EPSS 0.5%

    Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

  40. 8.3CVE-2026-63313EPSS 0.4%

    9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina…

  41. 7.2CVE-2026-21653EPSS 0.4%

    Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

  42. 4.1CVE-2026-48013EPSS 0.4%

    Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the p…

  43. 7.2CVE-2026-65516EPSS 0.3%

    Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

  44. 4.4CVE-2026-65496EPSS 0.2%

    Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

  45. 4.9CVE-2026-65467EPSS 0.2%

    Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

  46. 4.9CVE-2026-65466EPSS 0.2%

    Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

  47. 4.4CVE-2026-24639EPSS 0.2%

    Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.

  48. 9.8CVE-2026-64873EPSS 0.5%

    Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.

  49. 7.5CVE-2026-64799EPSS 0.4%

    Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save re…

  50. 6.5CVE-2026-13192EPSS 0.4%

    In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in o…