CVE-2026-61529

Name of the Vulnerable Software and Affected Versions Endatix versions prior to 0.7.0

Description The anonymous POST /forms/{formId}/submissions endpoint stores attacker-controlled JsonData after verifying only that the JSON is well formed. A file object containing name, type, and content fields can include an HTTP or HTTPS URL. When a staff member with submissions.view permission calls the POST /forms/{formId}/submissions/{submissionId}/files endpoint, the GetFilesHandler passes the stored data to the SubmissionFileExtractor function, which uses HttpClient.GetAsync without validating the destination URL, host, or resolved IP addresses against internal address ranges. This allows stored, second-order server-side GET requests to internal services, cloud metadata, loopback, and link-local addresses. For this to occur, the form must have IsPublic and IsEnabled set, and anonymous submissions must pass reCAPTCHA v3 if configured. The response is included in a ZIP file for the staff viewer rather than being returned to the attacker, making disclosure blind or indirect.

Recommendations Update to version 0.7.0.