CVE-2026-63313

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.72

Description A server-side request forgery (SSRF) issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled url parameter and passes it to an external scraping provider to fetch content. Because the URL is only validated for syntax and lacks a blocklist for private IP ranges, link-local addresses, internal hostnames, or cloud metadata endpoints (such as 169.254.169.254), an authenticated or locally-connected user can force the server to fetch arbitrary internal URLs. This allows read-access SSRF, which can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

Recommendations Update to version 0.4.72 or later. As a temporary workaround, restrict access to the '/v1/web/fetch' endpoint to minimize the risk of exploitation.