Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/goniszewski/grimoire/issues/237 Üçüncü taraf
• hackmd.io/@hieuPenguinnn/grimoire-fetch-metadata-ssrf Üçüncü taraf
• vulncheck.com/….0-unauthenticated-ssrf-via-api-fetch-metadata Üçüncü taraf
• github.com/goniszewski/grimoire Diğer
• github.com/…5.0/src/routes/api/fetch-metadata/%2Bserver.ts Diğer
• github.com/…oire/blob/v0.5.0/src/lib/utils/get-metadata.ts Diğer

Kayıt geçmişi

1. 30 Eki 2026 18:16Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-116252pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
• 9,1 CVE-2026-55598PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
• 8,6 CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
• 2,3 CVE-2026-61840Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
• 6,4 CVE-2026-119712PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
• 3,1 CVE-2026-100355Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard