PT-2026-36886

CVE-2026-42140

Published

2026-05-04

Updated

2026-05-05

Description by

CVSS 3.1

4.4

Medium

MetricsAV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PlantUML Macro versions prior to 2.4.1

Description PlantUML Macro, used for rendering UML diagrams from textual schemes, contains a Server-Side Request Forgery (SSRF) flaw. The application fails to validate the URL provided through the server parameter, allowing an attacker to specify an internal IP address or a malicious external URL. Consequently, the XWiki server attempts to connect to the supplied URL to render the diagram.

Recommendations Update to version 2.4.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Lukasz-Rybak

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers