PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…hub-ai/security/advisories/GHSA-mp2g-r37c-fx9q Üretici bülteni
• github.com/…ommit/16b05ed7c4c492330046fa10753389a5a5886613 Yama
• vulncheck.com/….10.0-ssrf-via-image-urls-in-indexed-documents Üçüncü taraf
• github.com/…p/modules/parsers/image_parser/image_parser.py Diğer
• github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0 Diğer
• github.com/pipeshub-ai/pipeshub-ai Diğer

Kayıt geçmişi

1. 30 Eki 2026 18:16Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-119711PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
• 7,1 CVE-2026-119710PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
• 5,8 CVE-2026-119709Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
• 3,1 CVE-2026-100355Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
• 6,5 CVE-2026-119575ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
• 2,7 CVE-2026-101209Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability.