Server-side request forgery in Wegow PDF export
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Wegow, a ticket sales platform, has a server-side request forgery flaw in its ticket sales chart PDF export, tracked as CWE-918. An authenticated user with a promoter account can change the svg parameter of the POST request sent when selecting Download PDF. The export.highcharts.com service then sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF, so the service can be used as an intermediary for these requests.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wegow Technologies | Wegow | actual version and later | — | No fix listed | CNA |
- Wegow VendorWegow Technologies Affected actual version and later Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Wegow.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-101300
- 2026-10-16 Alias added: GHSA-4f96-74rp-x9cg
References
Sources
- CVE-2026-101300 · CVE Program
- CVE-2026-101300 · NVD
- FIRST EPSS
- GHSA-4f96-74rp-x9cg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences