CVE-2026-125367
Received Received - Intake

Pico SSRF via Feeds Service in Arbitrary URL Fetching

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125367
EUVD
EUVD-2026-120530

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
picosh pico From 0 (inc) to 4.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Pico through version 4.1.2. It allows authenticated users to make the server fetch arbitrary URLs by uploading a feeds digest post with internal URLs and triggering immediate fetching via the run SSH command. The server's HTTP client does not validate requested URLs, enabling access to loopback addresses, private IP ranges (RFC1918), and cloud metadata endpoints.

Detection Guidance

Check Pico server logs for unusual outbound requests to loopback, RFC1918, or cloud metadata endpoints. Monitor SSH command execution logs for unauthorized 'run' commands triggering feed fetches. Inspect network traffic for unexpected connections from the Pico service to internal IPs.

Impact Analysis

An attacker could exploit this to probe internal services, use the server as a request relay, or access sensitive internal resources like cloud metadata endpoints. This could lead to data leaks, unauthorized access to internal systems, or further attacks against internal infrastructure.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Pico versions may face compliance violations if internal data is exposed through this flaw.

Mitigation Strategies

Upgrade Pico to the latest version with SSRF fixes. Implement network policies to block outbound requests to private/internal IPs. Restrict SSH command execution permissions for users. Monitor and audit feed service logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...