CVE-2026-18359

Name of the Vulnerable Software and Affected Versions Scripta eScriptorium versions prior to 26.04.2

Description An issue exists in the handling of METS and IIIF import URIs that allows a remote authenticated user to induce the server to send arbitrary HTTP requests to internal hosts, including cloud instance metadata services. This occurs because the IMPORT ALLOWED DOMAINS setting defaults to * and lacks address filtering, redirect caps, or timeouts. The issue is triggered via the mets uri or iiif uri parameters of the 'POST /api/documents/{pk}/imports/' endpoint.

Recommendations Update Scripta eScriptorium to version 26.04.2 or later. Restrict the IMPORT ALLOWED DOMAINS setting to a list of trusted domains instead of using the default wildcard.