CVE-2026-88892

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.1

Description The data importer fails to use the project's SSRF guard, instead utilizing a plain fetch mechanism to retrieve caller-supplied URLs. In the parseRemoteFile() function within packages/importer/src/providers/umami.ts, the config.fileUrl variable is validated only as a URL string, allowing requests to internal addresses such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/. An authenticated organization member can exploit this to force the server to connect to any reachable address. The server then returns the HTTP status and status text via import.get, creating a scanning oracle for internal hosts, ports, and paths. Additionally, if an internal response is formatted as a Umami CSV, the data is ingested as events and becomes visible in the attacker's analytics views. SSRF (Server-Side Request Forgery) is a flaw where an attacker forces a server to make requests to an unintended location.

Recommendations Update OpenPanel to a version later than 2.3.0. As a temporary workaround, restrict the use of the config.fileUrl parameter in the data importer to prevent requests to internal network addresses.