CVE-2026-18359

Katalog CVE

CVSS 8.5 · High EPSS 0,35%

Kerentanan Server-Side Request Forgery (SSRF) pada escriptorium. Skor CVSS 3.1 8.5 (High) menurut gitlab.com.

Deskripsi (NVD)

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.5 (High), sumber gitlab.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/scripta/escriptorium/-/work_items/1230 permissions required