CVE-2026-41170

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" `HttpClient` without any SSRF protection. A malicious or compromised admin can use this endpoint to probe internal network services, access cloud metadata endpoints, or perform internal reconnaissance. The vulnerability is authenticated (Admin-only) but highly impactful, allowing potential access to sensitive internal resources. Version 7.23.0 contains a fix.

Metrics

CVSS 4.0 7.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-411717.3Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request CVE-2026-411727.3Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allo CVE-2026-411735.9The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTe CVE-2026-411746.4Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in CVE-2026-411758.1Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters o CVE-2026-411769.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` CVE-2026-411775.5Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is CVE-2026-411785.3OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to CVE-2026-411799.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and CVE-2026-41184.3The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This CVE-2026-411807.5PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` val CVE-2026-411815.8Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerabili