CVE-2026-105438: Server-Side Request Forgery in O2OA

This vulnerability affects O2OA up to and including version 10.0.1-ce. The issue is located in the /x_general_assemble_control/jaxrs/excel/upload/with/url endpoint within the General Module's ActionUploadExcelWithUrl function. By manipulating the fileUrl parameter, an attacker can cause the server to make unintended requests to internal or external resources, constituting a server-side request forgery. The vulnerability is remotely exploitable and an exploit is publicly available. The vendor has been informed but has not provided a response or patch at the time of this report.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal systems or services not otherwise exposed. This can lead to information disclosure or further attacks leveraging internal network trust. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the remote exploitability and limited privileges required but low complexity and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing network-level protections such as restricting outbound HTTP requests from the affected service or applying web application firewall rules to detect and block malicious fileUrl parameter usage until an official fix is available.