Read the docs
TI-2026-69200 Aliases CVE-2026-107273GHSA-5724-58m3-c7r6

Gophish SSRF via POST /api/import/site

Priority MEDIUM 57CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery (CWE-918) in POST /api/import/site that lets an authenticated low-privileged user reach loopback and private hosts. The default dialer deny list does not block the internal URLs an attacker submits, and error messages expose service responses and reveal internal hosts and ports. CVSS 4.0 scores it 5.3 (MEDIUM), CISA's SSVC rates exploitation as poc and not automatable, a proof-of-concept exploit is referenced, and the flaw is not in CISA's KEV catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00199 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gophishgophish0.11.0 – 0.12.1—No fix listedCNA
  • gophish Vendorgophish Affected 0.11.0 – 0.12.1 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Gophish 0.11.0 through 0.12.1. Until a fix is released, limit who holds accounts on the instance and block requests from the Gophish server to loopback and private address ranges at the network layer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107273
  2. 2026-10-07 Alias added: GHSA-5724-58m3-c7r6
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: LOW → MEDIUM

References

Exploit 1

Other 3

  • TI-2026-56734 Gophish Account Lockout and Forced Password Change Bypassable via API Key CVSS 4.0HIGH 8.6
  • TI-2026-69198 Gophish Login Rate Limit Bypass via X-Forwarded-For Spoofing CVSS 4.0MEDIUM 6.9
  • TI-2026-69197 Gophish API lets users take over other users' objects CVSS 4.0HIGH 7.1
  • TI-2026-28778 Gophish 0.12.1 Denial of Service via Office Document Upload CVSS 4.0HIGH 7.1
  • TI-2026-69190 Username enumeration via login timing discrepancy in Gophish CVSS 4.0MEDIUM 6.3
  • TI-2026-69199 Cross-site scripting in Gophish via SMTP server error messages CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences