PT-2026-86390
CVE-2026-86119
·
تاريخ النشر
2026-09-05
·
تاريخ التحديث
2026-09-18
الوصف من
CVSS 4.0
9.2
حرجةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Webstudio versions prior to 0.296.0
Description
An unauthenticated server-side request forgery (SSRF) exists when the
RESIZE ORIGIN environment variable is unset. This allows attackers to provide arbitrary URLs to the '/cgi/image', '/cgi/video', and '/cgi/asset' proxy endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.Recommendations
Update to a version newer than 0.296.0.
Set the
RESIZE ORIGIN environment variable to restrict the proxy routes.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾