crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved… (CVE-2026-115411)

crawlseo before version 0.2.4 contains an SSRF vulnerability due to inadequate filtering in the isPrivateIp() function, which fails to block reserved IP ranges including RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges, and certain IPv6 addresses. Additionally, the function does not pin the validated IP address for the outbound connection, allowing a TOCTOU DNS rebinding bypass. An attacker with authentication can add a malicious domain resolving to internal or restricted IP addresses, trigger the crawler to fetch these addresses, and extract information such as the fetched page's title, description, headings, status code, and links through the crawl results API. This facilitates internal network reconnaissance and potential exposure of sensitive internal endpoints like cloud metadata services (e.g., 169.254.169.254).

An authenticated attacker can exploit this SSRF vulnerability to perform internal network reconnaissance by causing the crawler to access internal or restricted IP addresses. This may expose metadata endpoints and other internal services, potentially leaking sensitive information such as page titles and status codes. The vulnerability does not directly allow data modification or denial of service but can aid attackers in mapping internal network infrastructure.

A fix is available in crawlseo version 0.2.4 that addresses the SSRF vulnerability by improving IP range filtering and preventing TOCTOU DNS rebinding bypass. Users should upgrade to version 0.2.4 or later to remediate this issue. No additional mitigation guidance is provided in the vendor advisory.