CVE-2026-71250

Name of the Vulnerable Software and Affected Versions Firefly III (affected versions not specified)

Description An authenticated user with webhooks enabled can configure a webhook targeting loopback services on the server because the validator in IsValidWebhookUrl.php explicitly allows resolved addresses in the 127.0.0.0/8 range. Furthermore, the system is susceptible to DNS rebinding; the validator uses gethostbyname() during validation, but the outbound request in StandardWebhookSender.php re-resolves the hostname, allowing a request to be delivered to a private or internal address after passing validation with a public IP. This results in a blind Server-Side Request Forgery (SSRF), a condition where the server is coerced into making requests to an internal resource, but the response is only written to a server-side debug log and not returned to the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.