Executive Summary

CVE-2026-2558 is a server-side request forgery (SSRF) vulnerability found in GeekAI versions up to 4.2.4, specifically in the Download function within the file api/handler/net_handler.go.

The vulnerability occurs because the function accepts a URL argument from the user without any validation or authentication and directly uses it to make HTTP requests.

This allows an attacker to manipulate the URL parameter to make the server send requests to unintended destinations, potentially accessing internal services or sensitive resources.

The vulnerability can be exploited remotely without authentication, and a proof-of-concept exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to make the vulnerable server send arbitrary HTTP requests to internal or external systems.

Such unauthorized requests can lead to exposure of internal network services, unauthorized data access, or data exfiltration.

Attackers might access sensitive backend API ports or cloud metadata services, which can compromise the confidentiality, integrity, and availability of your system.

Because the server trusts user input without validation, it can be manipulated to perform SSRF attacks remotely without authentication.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring requests to the `/api/download` endpoint that include a URL parameter without proper validation. You can look for unusual or unexpected outbound HTTP requests originating from the server to internal IP addresses or cloud metadata endpoints, which may indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts, you can use network monitoring tools or logs to identify HTTP GET requests made by the server to suspicious or internal URLs.'}, {'type': 'paragraph', 'content': 'Suggested commands to help detect this vulnerability include:'}, {'type': 'list_item', 'content': "Using curl or wget to test the endpoint with a crafted URL parameter, for example: `curl 'http://<target-server>/api/download?url=http://169.254.169.254/latest/meta-data/'` to check if the server fetches internal cloud metadata."}, {'type': 'list_item', 'content': 'Using network monitoring tools like tcpdump or Wireshark to capture outbound HTTP requests from the server: `tcpdump -i eth0 host <target-server-ip> and port 80`.'}, {'type': 'list_item', 'content': 'Checking server logs for requests to `/api/download` with URL parameters pointing to internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16).'}] [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing authentication and authorization checks on the `/api/download` endpoint to prevent unauthorized access.

Additionally, enforce strict validation of the URL parameter by implementing a whitelist of allowed URLs or domains to prevent arbitrary requests.

Blocking requests to internal IP addresses and cloud metadata service endpoints is also recommended to reduce the risk of SSRF exploitation.

Since no official patch or response has been provided by the GeekAI project, consider replacing the affected component with an alternative product or disabling the vulnerable functionality until a fix is available.

Useful 0 Not Useful 0