CVE-2026-107394

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.13

Description Indico allows event organizers to submit crafted URLs that bypass validation filters to point to prohibited local targets, such as localhost or cloud metadata endpoints. This occurs because a previous fix did not cover a specific edge case, enabling a Server-Side Request Forgery (SSRF) where the organizer can read data returned by the target through affected features.

Recommendations Update to version 3.3.13. Use the http proxy and https proxy environment variables on the indico-uwsgi and indico-celery services to force outgoing requests through a proxy that limits access to sensitive targets.