Read the docs
TI-2026-83111 Aliases CVE-2026-100355

Server-side request forgery in Campfire link previews

Priority LOW 15CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Campfire, the once-campfire web chat application by basecamp, before 1.4.5 fetches links in chat messages to build OpenGraph previews. Its private-network guard misses several special-use ranges, including CGNAT, NAT64 and 6to4, which allows server-side request forgery (CWE-918). An authenticated user can post a link to a hostname resolving to those ranges to make the server request internal resources and return their OpenGraph metadata. The confidentiality impact is limited, and there is no integrity or availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed once-campfire (basecamp): 1.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
basecamponce-campfirebefore 1.4.51.4.5Patch availableCNA
  • once-campfire Vendorbasecamp Affected before 1.4.5 Fixed in 1.4.5 Patch available CNA

Remediation

Upgrade basecamp once-campfire to version 1.4.5, which contains the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA once-campfire (basecamp) Fixed in 1.4.5

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-100355
  2. 2026-11-05 CISA SSVC decision points changed

References

Other 4

  • TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
  • TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
  • TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
  • TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
  • TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
  • TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences