PT-2026-43396

CVE-2026-42335

Published

2026-05-26

Updated

2026-05-27

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.1

Description An issue exists in the OSS file service URL fetch endpoint "chat/api/oss/get url" where inconsistent URL parsing between the urlparse validation function and the requests HTTP client allows for a server-side request forgery (SSRF) bypass. This enables attackers to access internal network services.

Recommendations Update to version 2.8.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Fushuling

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers