CVE-2026-112237: CWE-918 Server-Side Request Forgery (SSRF) in TYPO3 Extension "Kitodo.Presentation"

The TYPO3 extension "Kitodo.Presentation" contains an SSRF vulnerability (CWE-918) due to a missing authorization check on one HTTP request method of its public proxy endpoint. This flaw allows unauthenticated attackers to cause the server to send requests to arbitrary hosts, including internal network resources. The attacker gains information through the status code and selected response headers returned by the server, which can be used to probe internal hosts and ports. The vulnerability affects versions >=0 <6.0.1 and >=7.0.0 <7.0.2 of the extension. No patch or official fix information is provided in the available data.

An unauthenticated attacker can exploit this SSRF vulnerability to make the TYPO3 server send arbitrary HTTP requests to internal or external hosts. This can be used to probe internal network infrastructure by analyzing response status codes and headers, potentially revealing sensitive information about internal services or network topology. However, response bodies are not disclosed, limiting the information leakage. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable proxy endpoint if possible, and monitor for unusual outbound requests from the server. Avoid exposing the vulnerable HTTP request method publicly. Follow vendor updates for patches or official mitigations.