Read the docs
TI-2026-16158 Aliases CVE-2026-19927GHSA-vv7q-2wgr-7w2p

OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed OpenBoxes: 0.9.8-hotfix1, 0.9.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—OpenBoxes0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; 0.9.6; 0.9.70.9.8-hotfix1, 0.9.8Patch availableCNA
  • OpenBoxes Vendor— Affected 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; 0.9.6; 0.9.7 Fixed in 0.9.8-hotfix1, 0.9.8 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA OpenBoxes Fixed in 0.9.8-hotfix1, 0.9.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19927
  2. 2026-10-03 Alias added: GHSA-vv7q-2wgr-7w2p

References

Exploit 1

Patch 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences