Read the docs
TI-2026-76574 Aliases CVE-2026-112254GHSA-8q52-22p3-3mxf

Server-side request forgery in clientst0r Property URL Importer

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

agit8or1 clientst0r versions up to 3.17.586 are affected. Manipulating the url argument of the _fetch_html function in the Property URL Importer causes server-side request forgery (CWE-918). A remote attacker with low privileges can make the server send requests to destinations the attacker chooses. The exploit has been publicly disclosed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed clientst0r (agit8or1): 3.17.587

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
agit8or1clientst0r3.17.5863.17.587Patch availableCNA
  • clientst0r Vendoragit8or1 Affected 3.17.586 Fixed in 3.17.587 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:agit8or1:clientst0r:*:*:*:*:*:*:*:*——agit8or1
  • cpe:2.3:a:agit8or1:clientst0r:*:*:*:*:*:*:*:* Versions — — ·agit8or1

Remediation

Upgrade agit8or1 clientst0r to version 3.17.587, which fixes the issue. The fixing patch is commit 7e75c6cc6a07621c10be9b07fafd99e89a02e327.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA clientst0r (agit8or1) Fixed in 3.17.587

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112254
  2. 2026-10-20 Alias added: GHSA-8q52-22p3-3mxf

References

Patch 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences