Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the… (CVE-2026-111663)

Chaskiq through version 2.0.3 contains a server-side request forgery vulnerability (CWE-918) in the createUrlUpload GraphQL mutation. Unauthenticated attackers can exploit this flaw by sending POST requests to /graphql with arbitrary URLs, including internal network or cloud instance metadata endpoints. The server fetches these URLs and returns the full response via an ActiveStorage blob URL, potentially exposing sensitive internal resources. The vulnerability has a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating critical impact on confidentiality with no required privileges or user interaction.

The vulnerability allows unauthenticated remote attackers to perform SSRF attacks, enabling them to access internal or cloud metadata endpoints and retrieve sensitive information. This can lead to exposure of confidential data hosted internally or in cloud environments. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the GraphQL endpoint and monitor for suspicious POST requests to /graphql. Consider implementing network-level controls to prevent the server from making unauthorized outbound requests to internal or sensitive endpoints.