SSRF Vulnerability in PinchTab /download Endpoint Allows Data Exfiltration

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-30834 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the PinchTab application, affecting versions prior to 0.7.7.'}, {'type': 'paragraph', 'content': "The vulnerability exists in the /download endpoint, where a user-supplied URL parameter is passed directly to the server's headless Chrome instance without validation or sanitization."}, {'type': 'paragraph', 'content': 'This allows an attacker with API access to make the PinchTab server request arbitrary URLs, including local system files (e.g., file:///etc/passwd), internal network services, and cloud metadata endpoints.'}, {'type': 'paragraph', 'content': 'The server then returns the full response content from these requests to the attacker, enabling exfiltration of sensitive data.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can severely impact confidentiality by allowing attackers to read sensitive local files, access internal network services, and retrieve cloud provider metadata.

Attackers can exploit this without any privileges or user interaction, and with low complexity, making it highly accessible.

Potential impacts include exposure of sensitive data, internal infrastructure probing, and unauthorized access to internal management interfaces or cloud credentials.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the vulnerable /download endpoint with crafted URLs that exploit the SSRF issue. For example, sending requests to the /download endpoint with URLs pointing to local files or internal services can reveal if the server is vulnerable.'}, {'type': 'list_item', 'content': 'Use curl commands to test the /download endpoint, such as:'}, {'type': 'list_item', 'content': 'curl -X GET "http://localhost:9867/download?url=file:///etc/passwd" to check if local files can be accessed.'}, {'type': 'list_item', 'content': 'curl -X GET "http://localhost:9867/download?url=http://localhost:8080/internal-admin" to check access to internal network services.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the PinchTab application to version 0.7.7 or later, where this SSRF vulnerability in the /download endpoint has been patched.

Until the upgrade can be performed, restrict or disable access to the /download endpoint to trusted users only, and avoid exposing the API externally to reduce the risk of exploitation.

Useful 0 Not Useful 0