Server-Side Request Forgery in TiBillet Lespass API

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument img_url/image_url can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: "[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112358

Affected Vendors & Products

Vendor	Product	Version / Range
TiBillet	Lespass	10e87909c5d526dffa6d424c104fc12860740537

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in TiBillet Lespass affecting the APIv1 component. It exists in the get_img_from_url function of ApiBillet/serializers.py where manipulating the img_url or image_url argument can lead to unauthorized server requests. The vendor notes that fixes like destination IP validation and timeout limits are planned for v2 API, while v1 API will be removed in the next major release.

Impact Analysis

An attacker could exploit this to make the server send requests to internal systems or external addresses, potentially accessing sensitive data or services. The high attack complexity and difficulty of exploitation reduce risk but do not eliminate it entirely. Impact includes unauthorized data exposure or service disruption if exploited.

Mitigation Strategies

Disable or remove the affected v1 API endpoints in TiBillet Lespass immediately as the vendor has planned to remove them in the next major release. Ensure the v2 API is used instead, which includes destination IP validation, redirect re-checks, timeout, and size limits on remote image downloads.

Hi! I’m here to help you understand CVE-2026-112358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70