PT-2026-141189
CVE-2026-125366
·
Published
2026-11-09
·
Updated
2026-11-10
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.
Found an issue in the description? Have something to add? Feel free to write us 👾