CVE-2026-72606

Name of the Vulnerable Software and Affected Versions Pinry versions prior to 2.1.14

Description A server-side request forgery (SSRF) issue exists in the pin-from-URL feature. This occurs because the application passes a user-supplied URL directly to the requests.get() function without validating the host or IP address. Since ALLOW NEW REGISTRATIONS is set to true by default, unauthenticated remote attackers can trigger this behavior to force the server to send HTTP requests to arbitrary internal or external hosts, potentially accessing internal services or cloud metadata endpoints.

Recommendations Update Pinry to version 2.1.14 or later. Set the ALLOW NEW REGISTRATIONS variable to false to prevent anonymous triggering of the feature.