A vulnerability was found in OpenBoxes up to 0.9.7. (CVE-2026-19927)
A server-side request forgery (SSRF) vulnerability exists in OpenBoxes up to version 0.9.7 in the Product Upload Endpoint. This vulnerability is due to improper validation of the params.url argument in the Upload function of ProductController.groovy. Remote attackers can exploit this flaw to cause the server to make unintended requests. The issue is resolved by upgrading to versions 0.9.8-hotfix1 or 0.9.8.
AI Analysis
Technical Summary
OpenBoxes versions up to 0.9.7 contain an SSRF vulnerability in the Upload function of the Product Upload Endpoint (ProductController.groovy). Manipulation of the params.url argument allows remote attackers to induce the server to send crafted requests to arbitrary URLs. This vulnerability is tracked as CVE-2026-19927 and has a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Public exploit code exists. The vulnerability is fixed in OpenBoxes versions 0.9.8-hotfix1 and 0.9.8 with patch a599007325efe780a21b3537ecce3ca25635c926.
Potential Impact
Successful exploitation can lead to server-side request forgery, potentially allowing attackers to make unauthorized requests from the vulnerable server. This may result in limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The vulnerability requires low attack complexity and privileges but no user interaction. No known active exploitation in the wild has been reported.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.8-hotfix1 or 0.9.8 to apply the official patch (commit a599007325efe780a21b3537ecce3ca25635c926). This upgrade fully resolves the SSRF vulnerability. No additional mitigations are required if the upgrade is applied.
A vulnerability was found in OpenBoxes up to 0.9.7. (CVE-2026-19927)
Description
A server-side request forgery (SSRF) vulnerability exists in OpenBoxes up to version 0.9.7 in the Product Upload Endpoint. This vulnerability is due to improper validation of the params.url argument in the Upload function of ProductController.groovy. Remote attackers can exploit this flaw to cause the server to make unintended requests. The issue is resolved by upgrading to versions 0.9.8-hotfix1 or 0.9.8.
CVSS v3.1
Score 6.3medium
Affected software
pkg:github/openboxes/OpenBoxesRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenBoxes versions up to 0.9.7 contain an SSRF vulnerability in the Upload function of the Product Upload Endpoint (ProductController.groovy). Manipulation of the params.url argument allows remote attackers to induce the server to send crafted requests to arbitrary URLs. This vulnerability is tracked as CVE-2026-19927 and has a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Public exploit code exists. The vulnerability is fixed in OpenBoxes versions 0.9.8-hotfix1 and 0.9.8 with patch a599007325efe780a21b3537ecce3ca25635c926.
Potential Impact
Successful exploitation can lead to server-side request forgery, potentially allowing attackers to make unauthorized requests from the vulnerable server. This may result in limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The vulnerability requires low attack complexity and privileges but no user interaction. No known active exploitation in the wild has been reported.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.8-hotfix1 or 0.9.8 to apply the official patch (commit a599007325efe780a21b3537ecce3ca25635c926). This upgrade fully resolves the SSRF vulnerability. No additional mitigations are required if the upgrade is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vv7q-2wgr-7w2p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19927"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a81d703bf8831d5394a1034
Added to database: 08/16/2026, 15:28:03 UTC
Last enriched: 08/16/2026, 15:30:41 UTC
Last updated: 08/17/2026, 03:41:00 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.