CVE-2026-55421

Name of the Vulnerable Software and Affected Versions Open edX Platform versions prior to commit 00b7c3c

Description An issue exists where the platform performs a server-side fetch using the requests.get(url, allow redirects=True) function. The endpoint accepts user-supplied files[].url and returns the fetched bytes within a ZIP response, enabling Server-Side Request Forgery (SSRF), which allows an attacker to induce the server to make requests to an arbitrary domain and exfiltrate the response. The fetch path lacks a timeout and allows following redirects.

Recommendations Update Open edX Platform to the version containing commit 00b7c3c.