Threats tagged 'ghsa-5r5q-7f5q-f5h2'

PipesHub versions before 0.10.0 have a server-side request forgery (SSRF) vulnerability in the ImageParser._fetch_single_url function. This flaw allows attackers to cause the indexing service to fetch internal network addresses by embedding malicious image URLs in documents. Attackers can exploit this by supplying Markdown or HTML content through uploads, synced mailboxes, or web connectors, potentially accessing loopback, private network, or cloud metadata endpoints. The fetched image responses are then embedded into the indexed content, which could lead to information disclosure.