CVE-2026-49345

Name of the Vulnerable Software and Affected Versions Mercator versions prior to 2025.05.19

Description A Server-Side Request Forgery (SSRF) exists in the CVE configuration panel at the '/admin/config/parameters' endpoint. The testProvider() method in ConfigurationController passes user-supplied input to curl init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the server to issue arbitrary outbound network requests. The suffix '/api/dbInfo' appended to the URL can be bypassed by injecting a # fragment character, granting full control over the target URL. There is no scheme whitelist, host whitelist, or private/loopback IP block. The telnet:// scheme allows internal port scanning, and the gopher:// scheme enables interaction with unauthenticated internal services like Redis or Memcached, which may lead to Remote Code Execution (the ability to execute arbitrary commands on the host machine) under specific deployment conditions.

Recommendations Update to version 2025.05.19.