CVE-2026-111720: Server-Side Request Forgery (SSRF) in lhccong fish-island-backend

The fish-island-backend component in the lhccong project contains an unauthenticated SSRF vulnerability up to commit 7c61b78. The flaw exists in the GET /api/web/parse endpoint, which accepts a url parameter that is used by the server to fetch external resources. Because the server follows redirects using OkHttp, attackers can coerce it into making requests to internal network services, loopback addresses, or cloud provider metadata endpoints. The server then returns extracted metadata such as page titles, meta descriptions, and favicons from the fetched content. This SSRF can be exploited remotely without authentication, potentially exposing sensitive internal resources or information.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the server perform HTTP requests to arbitrary URLs, including internal network services and cloud metadata endpoints. This can lead to information disclosure of internal resources and metadata that are normally inaccessible externally. The vulnerability does not require user interaction or privileges and has a medium severity rating (CVSS 6.9). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and implement network-level controls to limit the server's ability to make arbitrary outbound requests. Monitor for unusual request patterns targeting the /api/web/parse endpoint. Avoid exposing sensitive internal services to the server hosting fish-island-backend.