CVE-2026-15525

Name of the Vulnerable Software and Affected Versions kLOsk adloop versions prior to 0.10.0

Description A remote attacker can perform server-side request forgery (SSRF), a technique used to induce the server to make requests to an unintended location, by manipulating the final url argument within the validate urls() function located in the src/adloop/ads/write.py file.

Recommendations Update to version 0.10.0. As a temporary mitigation, restrict the use of the validate urls() function.