CVE-2026-4964

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Server-Side Request Forgery (SSRF) pada letta. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/fde4d5ed6ac4aa876f73f8954c6214da exploit · advisory pihak ketiga
• https://vuldb.com/?id.353841 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.777645 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.353841 permissions required · vdb entry