Threats tagged 'ghsa-hggc-x5gr-37ph'

Feehi CMS version 2.1.1 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The vulnerability arises because the private-IP validation does not block loopback or link-local addresses, enabling an attacker to make the server send HTTP requests to internal services. This could lead to unauthorized information disclosure from internal network resources.