PT-2026-145480
CVE-2026-68507
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
ideon versions prior to 0.9.5
Description
The link-preview endpoint does not require authentication and forwards supplied URLs directly into a server-side fetch. Although a general-purpose SSRF guard is implemented via the
validateSafeUrl function within safeFetch in src/app/lib/ssrf.ts, the endpoint remains open to anonymous users. Additionally, the IP blocklist contains a gap allowing access to the server's loopback interface using the 0.0.0.0 address, which is a technique used to evade SSRF filters on Linux. SSRF (Server-Side Request Forgery) is a flaw where an attacker can induce the server to make requests to an unintended location.Recommendations
Update to version 0.9.5.
Found an issue in the description? Have something to add? Feel free to write us 👾