Read the docs
TI-2026-29800 Aliases CVE-2026-41177

Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction

Priority MEDIUM 58CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied `Url` parameter, allowing the use of the `file://` protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Fixed squidex (Squidex): 7.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Squidexsquidexbefore 7.23.07.23.0Patch availableCNA
  • squidex VendorSquidex Affected before 7.23.0 Fixed in 7.23.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:squidex.io:squidex:*:*:*:*:*:*:*:*——Squidex
  • cpe:2.3:a:squidex.io:squidex:*:*:*:*:*:*:*:* Versions — — ·Squidex

Remediation

  • Fix · CNA squidex (Squidex) Fixed in 7.23.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41177

References

Other 2

  • TI-2026-19941 Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration CVSS 3.1CRITICAL 9.1
  • TI-2023-24880 Remote code execution in Squidex CVSS 3.1CRITICAL 9.1
  • TI-2026-29795 Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets) CVSS 4.0HIGH 7.3
  • TI-2026-29794 SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient CVSS 4.0HIGH 7.3
  • TI-2026-29793 Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests CVSS 4.0HIGH 7.2
  • TI-2023-00608 Cross-Site Request Forgery (CSRF) in squidex/squidex CVSS 3.1MEDIUM 6.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences