Read the docs
TI-2026-85079 Aliases CVE-2026-122008GHSA-p838-xx56-rf99

Server-side request forgery in Oqtane Framework file upload from URL

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Oqtane Framework from 1.0.0 before 10.3.0 contains a server-side request forgery flaw in the UploadFile endpoint of FileController.cs, where the url parameter is passed to HttpClient.GetStreamAsync without validating the scheme, host, or IP address (CWE-918). An authenticated registered user can make the server fetch arbitrary URLs, including cloud instance metadata services and localhost-bound management interfaces. The fetched response is saved as a file in the attacker's own user folder, which they can then retrieve through the download endpoint to read internal data or map internal hosts and ports.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00259 17th percentileScored 2026-11-07
Fix Fixed oqtane.framework (oqtane): 10.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oqtaneoqtane.framework1.0.0 to before 10.3.010.3.0Patch availableCNA
  • oqtane.framework Vendoroqtane Affected 1.0.0 to before 10.3.0 Fixed in 10.3.0 Patch available CNA

Remediation

Upgrade oqtane.framework to version 10.3.0 or later, which contains the fix. The sources list no further advisory identifiers for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA oqtane.framework (oqtane) Fixed in 10.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    oqtane.framework 10.3.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-85078 Broken access control in Oqtane Framework settings API exposes other sitesPriority LOW 35
    Show all 2 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122008
  2. 2026-11-04 Alias added: GHSA-p838-xx56-rf99
  3. 2026-11-04 CISA SSVC decision points changed

References

Patch 1

Other 1

  • TI-2026-85078 Broken access control in Oqtane Framework settings API exposes other sites CVSS 4.0HIGH 7.4
  • TI-2026-75402 Authorization bypass in Oqtane exposes other sites' SMTP secrets CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences