Server-side request forgery in TiBillet Lespass APIv1 image fetch
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
TiBillet Lespass up to commit 10e87909c5d526dffa6d424c104fc12860740537 contains a server-side request forgery in the get_img_from_url function of the APIv1 serializers. Manipulating the img_url or image_url argument can make the server send requests to destinations chosen by the attacker (CWE-918). The attack can be launched remotely, but it has high complexity, requires high privileges, and is reported as difficult to exploit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument img_url/image_url can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: "[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release."
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for TiBillet Lespass. The vendor plans to fix this in its v2 API, which replaces the affected v1 endpoints, and will remove the v1 API in its next major release.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-20 Threatist record created from CVE-2026-112358
- 2026-10-20 Alias added: GHSA-jgh9-mwr6-9jc2
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: LOW → MEDIUM
References
—
Sources
- CVE-2026-112358 · CVE Program
- CVE-2026-112358 · NVD
- FIRST EPSS
- GHSA-jgh9-mwr6-9jc2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences