CVE-2026-108770: Server-Side Request Forgery in Appwrite
Description
CVE-2026-108770 is a server-side request forgery (SSRF) vulnerability in Appwrite versions 2.0 through 2.3.0. It affects the PublicHostname function in the Browser Screenshot Service component. This vulnerability allows remote attackers to manipulate the url argument, potentially causing the server to make unintended requests. The issue is resolved by upgrading to version 2.4.0.
CVSS v4.0
Score 6.9medium
Affected software
Appwrite
pkg:github/appwrite/appwritecpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the PublicHostname function of the Browser Screenshot Service in Appwrite up to version 2.3.0. The manipulation of the url argument leads to server-side request forgery, enabling an attacker to make the server perform unauthorized requests. The vulnerability is fixed in Appwrite version 2.4.0, as indicated by the patch identified by commit 393255e7302ae5503331d45802e2eee01c6a47fe.
Potential Impact
An attacker can remotely exploit this vulnerability to induce the server to send crafted requests to internal or external resources, potentially bypassing network restrictions or accessing sensitive information. The CVSS 4.0 score of 6.9 (medium severity) reflects the network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.
Mitigation Recommendations
Upgrade Appwrite to version 2.4.0 or later, which contains the official fix for this SSRF vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-11T07:23:33.337Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acc0ed92cdf04f65605296c
Added to database: 10/11/2026, 22:34:01 UTC
Last enriched: 10/11/2026, 22:48:14 UTC
Last updated: 10/11/2026, 22:49:04 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.