CVE-2026-11437 is a server-side request forgery vulnerability affecting the checkServer function in the /install/checkServer component of perfree go-fastdfs-web versions 1.3.0 through 1.3.7. An attacker can remotely manipulate this function to cause the server to make unintended requests, potentially leading to information disclosure or interaction with internal systems. The vulnerability is publicly known, and an exploit has been published. The vendor has not provided any response or remediation guidance, and no patch is currently available.

Successful exploitation allows an unauthenticated remote attacker to perform server-side request forgery, potentially enabling the attacker to make arbitrary requests from the vulnerable server. This can lead to information disclosure or interaction with internal network resources. The vulnerability is rated medium severity with a CVSS score of 6.9, reflecting the network attack vector, low complexity, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level mitigations such as restricting outbound requests from the affected server or applying web application firewall rules to detect and block SSRF attempts until a patch is released.