CVE-2026-41172
Received Received - Intake
SSRF Vulnerability in Squidex Asset Upload Allows Internal Access

Publication date: 2026-04-22

Last updated on: 2026-04-23

Assigner: GitHub, Inc.

Description
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-04-23
EPSS Evaluated
2026-06-15
NVD
CVE-2026-41172
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
squidex squidex to 7.23.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The impact of this vulnerability is that an attacker with asset upload permissions can make the server access internal or external URLs that it normally should not. This can lead to unauthorized access to internal services or sensitive data within private networks. Additionally, the attacker can persist the fetched data as assets, potentially leading to data leakage or further exploitation.

Mitigation Strategies

To mitigate this SSRF vulnerability in Squidex, you should upgrade to version 7.23.0 or later, which contains the fix.

Executive Summary

This vulnerability exists in Squidex, an open source headless content management system. Before version 7.23.0, a user who has permission to upload assets can exploit a Server-Side Request Forgery (SSRF) vulnerability. This allows the user to make the server fetch arbitrary URLs, including those on localhost or private networks, and then save the fetched response as an asset.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart