Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The `$result` handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's `jobs/<jobId>` directory. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.
CVE-2026-15570 is a server-side request forgery (SSRF) vulnerability in the Telefunken TE24553B45V2DZ Smart TV running Vestel MB181 / Voltron181 / TiVo OS platform. It allows an attacker on the same local network to make the embedded browser send requests to internal or loopback addresses that are normally inaccessible. The vulnerability affects firmware version 2.78.0.0 and is fixed in version 2.85.2.0.
CVE-2026-16637 is a server-side request forgery (SSRF) vulnerability in OPeNDAP Inc.'s hyrax-docker version 1.18.0. It allows attackers to bypass the AllowedHosts allowlist via unvalidated HTTP redirects, leading to leakage of Earthdata headers including User-Id and Echo-Token to attacker-controlled endpoints. This vulnerability can expose sensitive credential information but does not impact data integrity or availability.
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm)
accepts a “pathname” parameter, which can be set to network locations
using UNC paths (e.g., “\\Server\Share”). The server processes these
paths without validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables authenticated attackers to
trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts
an arbitrary path, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables au-thenticated attackers
to trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a
@@INCLUDE command, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables authenticated attackers to
trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot”
parameter, which can be set to network locations using UNC paths (e.g.,
“\\Server\Share”). The server processes these paths without validation,
resulting in outbound connection attempts to attacker-controlled SMB
servers. This enables unauthenticated attackers to trigger the server to
authenticate to arbitrary SMB endpoints, potentially exposing NTLM
authentication information (such as NTLM hashes). If outbound
connections to port 445 (SMB) are permitted, attackers can use this to
conduct SMB relay or credential theft attacks. Exploitation of the
“pathnameroot” parameter is possible without authentication.This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
CVE-2026-16027 is a Server-Side Request Forgery (SSRF) vulnerability in the Revenue Administration Türkiye's E-Signature product. It affects versions from 2.4.4.0 up to but not including 2.5.1.0. The vulnerability allows an attacker to induce the server to make unintended requests. The CVSS score is 5.4, indicating a medium severity level. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-62857 is a Server-Side Request Forgery (SSRF) vulnerability in the fedify TypeScript library used for building federated server apps powered by ActivityPub. Versions from 1.2.0 up to but not including 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2 are affected. The vulnerability arises because the getNodeInfo() function follows attacker-controlled links[].href values from /.well-known/nodeinfo without validating the scheme, redirects, or private addresses. This allows an attacker to make requests to internal network services such as loopback, link-local, cloud metadata, and private network endpoints and receive their response bodies. The issue is fixed in the specified patched versions.
Ground Station versions prior to 0.6.0 contain an unauthenticated blind server-side request forgery (SSRF) vulnerability. This flaw allows any unauthenticated Socket.IO client to cause the server to issue outbound HTTP requests to attacker-controlled destinations. The vulnerability arises from disabled authentication enforcement, a wildcard CORS policy, and lack of validation on URLs stored and used in scheduled sync tasks. The malicious URL persists in the database and triggers repeated SSRF every 24 hours without requiring attacker presence.
CVE-2026-18359 is a server-side request forgery (SSRF) vulnerability in Scripta eScriptorium versions prior to 26.04.2. It arises from the METS and IIIF import URI handling, where an authenticated remote user can cause the server to make arbitrary HTTP requests to internal hosts. This is due to the default setting of IMPORT_ALLOWED_DOMAINS to '*' and the lack of address filtering, redirect caps, or timeouts on the mets_uri or iiif_uri parameters in the import API endpoint.
CVE-2026-12605 is a critical vulnerability in Eclipse GlassFish versions 8.0.0 before 8.0.4. It involves a combination of CSRF and SSRF vulnerabilities in the DownloadServlet ContentSources that can leak the admin gfresttoken to an attacker-controlled host if the victim is authenticated in the Admin Console. This leakage allows an unauthenticated attacker to fully take over the Eclipse GlassFish domain until the token expires.
CVE-2026-18597 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Foxit Software Inc.'s Foxit PDF Services API. The vulnerability arises because the PDF creation feature allows referencing external files and uses URL redirection to bypass local file access restrictions. This flaw can lead to information disclosure. There is no confirmed patch or official remediation available at this time. No known exploits in the wild have been reported.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Newsletters WordPress plugin before version 4.16. The plugin does not authenticate or validate bounce-processing requests before fetching user-supplied URLs, allowing unauthenticated attackers to make the server issue requests to arbitrary internal or external hosts. This vulnerability has a high severity with a CVSS score of 8.2.