CVE-2026-118577

Received Received - Intake

Server-Side Request Forgery in MusicFreeDesktop

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulDB

Description

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-28

Last Modified

2026-10-28

Generated

2026-10-29

AI Q&A

2026-10-29

EPSS Evaluated

N/A

NVD

CVE-2026-118577

EUVD

EUVD-2026-112547

Affected Vendors & Products

Vendor	Product	Version / Range
maotoumao	MusicFreeDesktop	0.0.6
maotoumao	MusicFreeDesktop	0.0.7
maotoumao	MusicFreeDesktop	0.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8. It allows remote attackers to manipulate requests via an unknown function in the Request Forwarder component, potentially leading to unauthorized access or data exfiltration.

Impact Analysis

An attacker could exploit this to send crafted requests from the vulnerable server to internal systems or external targets, bypassing firewalls or accessing restricted resources. This may lead to data leaks, unauthorized actions, or further network compromise.

Compliance Impact

SSRF can violate compliance by exposing sensitive data or enabling unauthorized access to systems handling personal or health information. GDPR and HIPAA require protecting such data; a breach could result in legal penalties or reputational damage.

Mitigation Strategies

Apply the patch with identifier b0d3876247a0a64fa0e430e4b21870e41f503182 to fix the server-side request forgery vulnerability in maotoumao MusicFreeDesktop.

Hi! I’m here to help you understand CVE-2026-118577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70