CVE-2026-65318

Name of the Vulnerable Software and Affected Versions Verba RAG application version 2.1.3

Description An unauthenticated server-side request forgery (SSRF) allows attackers to force the backend to issue arbitrary HTTP GET requests. By connecting to the '/ws/import files' WebSocket endpoint without authentication and specifying arbitrary URLs in the HTMLReader configuration, an attacker can cause the server to fetch internal resources, such as co-located database endpoints or cloud instance metadata services, to retrieve sensitive credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.