CVE-2026-42141 is a CWE-918 SSRF vulnerability affecting xibo-cms before version 4.4.1. It allows authenticated users with specific permissions to induce the server to send crafted HTTP requests to arbitrary locations, potentially exposing internal network resources or sensitive metadata endpoints. The vulnerability has a CVSS 3.1 base score of 7.7 (high severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality impact. The vendor has released version 4.4.1 which addresses this issue. The product is a cloud-hosted service, so the vendor manages remediation on the server side.

Exploitation allows an authenticated user with Library upload permissions to perform SSRF attacks from the CMS server, potentially leading to internal network scanning, unauthorized access to cloud metadata services (e.g., AWS IMDS), interaction with internal unauthenticated services, and exfiltration of sensitive data. Confidentiality is impacted, but integrity and availability are not directly affected according to the CVSS vector. No known exploits in the wild have been reported.

Upgrade xibo-cms to version 4.4.1 or later, where this SSRF vulnerability is fixed. Since this is a cloud-hosted service, the vendor manages remediation on the server side; verify with the vendor advisory that your instance is updated. No additional mitigation actions are indicated by the vendor advisory.