CVE-2026-112358: Server-Side Request Forgery in TiBillet Lespass

This vulnerability exists in TiBillet Lespass up to commit 10e87909c5d526dffa6d424c104fc12860740537, specifically in the get_img_from_url function of ApiBillet/serializers.py within the APIv1 component. Manipulating the img_url or image_url argument can lead to SSRF, enabling an attacker to make the server perform unauthorized requests. The attack requires high complexity and privileges, making exploitation difficult. The vendor confirms that a fix involving destination IP validation, redirect re-checks, and timeout and size limits on remote image downloads is planned for the v2 API, which will replace the affected v1 endpoints. The v1 API and its vulnerable serializers will be removed in the next major release.

Successful exploitation could allow an attacker to cause the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise accessible. However, the attack complexity is high and requires privileges, limiting the likelihood of exploitation. No known exploits are reported in the wild. The CVSS 4.0 score is low (2.1), reflecting limited impact and difficult exploitability.

The vendor has stated that the vulnerability will be addressed in the upcoming v2 API through destination IP validation, redirect re-checks, and imposing timeout and size limits on remote image downloads. The vulnerable v1 API, including the affected serializers, will be removed in the next major release. Until then, no official patch is available. Users should plan to migrate to the v2 API once released to mitigate this issue. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.