CVE-2026-2532

Katalog CVE

CVSS 9.8 · Critical EPSS 0,26%

Kerentanan Server-Side Request Forgery (SSRF) pada lintsinghua deepaudit. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.0.4 and 3.1.0 is capable of addressing this issue. The patch is named da853fdd8cbe9d42053b45d83f25708ba29b8b27. It is suggested to upgrade the affected component.

Rincian

Terbit di NVD

16 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lintsinghua/DeepAudit/commit/da853fdd8cbe9d42053b45d83f25708ba29b8b27 patch
• https://github.com/lintsinghua/DeepAudit/pull/145 issue tracking · patch
• https://vuldb.com/?id.346120 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.748220 advisory pihak ketiga · vdb entry
• https://github.com/lintsinghua/DeepAudit/ product
• https://github.com/lintsinghua/DeepAudit/issues/144 issue tracking
• https://github.com/lintsinghua/DeepAudit/releases/tag/v3.0.4 release notes
• https://vuldb.com/?ctiid.346120 permissions required · vdb entry