CVE-2026-49328

MediumCVSS 5.3/10Last modified Jul 22, 2026

Description

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Fesod (Incubating)	< 2.0.2-incubating

References

https://fesod.apache.org/docs/downloadProduct
https://github.com/apache/fesod/pull/917Issue Tracking, Patch
https://github.com/apache/fesod/releases/tag/2.0.2-incubatingRelease Notes
https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkjMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/01/4

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-493297.5A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to gola CVE-2026-49337.5Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Pe CVE-2026-493316.5A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplie CVE-2026-493328.5A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but CVE-2026-493365.5@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0 CVE-2026-493374.3libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `d CVE-2026-493387.1gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/CVE-2026-493397.1gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c9 CVE-2026-493408.1gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreate CVE-2026-493425.3YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a reque CVE-2026-493435.9Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnera CVE-2026-493447.1Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Eng