CVE-2026-22662

Katalog CVE

CVSS 4.3 · Medium EPSS 0,19%

Kerentanan Server-Side Request Forgery (SSRF) pada fka prompts.chat. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/f/prompts.chat/pull/1102 issue tracking · mitigasi · advisory vendor
• https://github.com/f/prompts.chat/commit/1464475df2698fb7ccd0cdbc382b0750466f891d patch
• https://www.vulncheck.com/advisories/prompts-chat-blind-ssrf-via-media-generate advisory pihak ketiga