CVE-2026-112254: Server-Side Request Forgery in agit8or1 clientst0r

The vulnerability exists in the _fetch_html function of the file locations/services/property_url_importer.py within the Property URL Importer component of agit8or1 clientst0r. By manipulating the url argument, an attacker can cause server-side request forgery, making the server perform unauthorized requests. This vulnerability affects version 3.17.586 and was addressed by the vendor with an official patch in version 3.17.587. The vendor was contacted early and released the fix quickly. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, low confidentiality impact, and no integrity or availability impact.

The vulnerability allows remote attackers to cause the server to make unintended requests to arbitrary URLs, which could lead to information disclosure or interaction with internal systems. However, the impact is limited to low confidentiality impact with no integrity or availability impact as per the CVSS vector. There are no known exploits in the wild at this time.

Upgrade agit8or1 clientst0r to version 3.17.587 or later, which contains the official fix for this vulnerability. The vendor has released this patch promptly after disclosure. No additional mitigation steps are required beyond applying the official update.