CVE-2026-54166 describes an SSRF vulnerability in Shelf-nu's Asset CSV Content Import feature affecting versions prior to 1.20.3. Authenticated users with the 'asset:import' permission can bypass the imageUrl validation through multiple techniques such as image-extension suffixes, path keywords, domain substring matching, and redirect chains. The server then performs an unrestricted fetch() request to the supplied URL, enabling SSRF attacks that can reach internal network services, cloud metadata endpoints, and arbitrary external hosts. The server also fully buffers response bodies before size validation, creating a potential memory exhaustion vector. The issue is fixed in version 1.20.3.

Successful exploitation allows an authenticated user with limited permissions to make the server perform arbitrary HTTP requests within its network context, potentially accessing sensitive internal services and cloud metadata endpoints. This can lead to information disclosure and further internal network compromise. The memory exhaustion vector could cause denial of service due to resource exhaustion. The CVSS 3.1 score is 7.1 (High), reflecting high confidentiality impact and low attack complexity with required privileges.

Upgrade Shelf-nu to version 1.20.3 or later, where this SSRF vulnerability is patched. No other mitigations are required as the official fix addresses the issue.