wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export. (CVE-2026-82081)

The SSRF vulnerability in wallabag versions 2 through 2.6.14 arises from mishandling of crafted input in the title or content fields during the PDF export functionality. This can lead to the server making unauthorized requests to internal or external resources. The vulnerability is tracked as CVE-2026-82081 and is classified under CWE-918 (Server-Side Request Forgery). The CVSS 3.1 vector indicates it requires network access, low attack complexity, low privileges, no user interaction, and impacts confidentiality and integrity with a scope change.

An attacker with low privileges can exploit this vulnerability to cause the wallabag server to perform unintended network requests, potentially accessing internal services or sensitive information. The impact includes partial loss of confidentiality and integrity but no availability impact is noted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the PDF export functionality or sanitizing inputs used in PDF generation to mitigate SSRF risks.