Threats affecting pkg:maven/Apache Software Foundation/org.apache.fesod:fesod-sheet

CVE-2026-107460 is a critical Server-Side Request Forgery (SSRF) vulnerability in Apache Fesod (Incubating) version 2.0.2-incubating. The flaw involves a DNS rebinding bypass in the UrlImageConverter component, allowing attackers to bypass hostname validation and access internal restricted addresses. Apache has mitigated this issue in version 2.1.0-incubating by disabling remote URL image fetching by default and requiring an explicit allowlist for trusted hosts.

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.