CVE-2026-107460

Name of the Vulnerable Software and Affected Versions Apache Fesod (Incubating) fesod-sheet version 2.0.2-incubating

Description The UrlImageConverter component is susceptible to Server-Side Request Forgery (SSRF) via a DNS rebinding bypass. This occurs when an application accepts an attacker-controlled image URL for spreadsheet writing; the converter validates the resolved IP addresses of the hostname but subsequently opens a separate connection that may resolve the hostname again. An attacker controlling DNS responses can redirect the connection to a restricted address after the initial validation.

Recommendations Upgrade to version 2.1.0-incubating. If remote URL image fetching is enabled, allowlist only hostnames with trusted DNS and HTTP services.