CVE-2026-49328
SSRF in Apache Fesod (Incubating) UrlImageConverter
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | fesod | to 2.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the Server-Side Request Forgery (SSRF) vulnerability in Apache Fesod on compliance with common standards and regulations such as GDPR or HIPAA.
However, SSRF vulnerabilities can potentially lead to unauthorized access to internal resources or sensitive data, which might indirectly affect compliance with data protection regulations if exploited.
Users are recommended to upgrade to version 2.0.2-incubating, which includes security improvements such as URL scheme policies and network restrictions to mitigate this vulnerability.
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) issue found in the UrlImageConverter component of Apache Fesod (Incubating) versions before 2.0.2-incubating. It allows attackers to make the server send outbound network requests to internal or otherwise restricted resources by supplying a malicious image URL.
How can this vulnerability impact me? :
The SSRF vulnerability can allow attackers to access internal network resources that are normally protected, potentially leading to unauthorized data access or further exploitation within the internal network. This can compromise the confidentiality and integrity of internal systems by enabling attackers to bypass network restrictions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves Server-Side Request Forgery (SSRF) via user-supplied image URLs in the UrlImageConverter component of Apache Fesod before version 2.0.2-incubating. Detection would involve monitoring outbound network requests initiated by the application to internal or restricted resources triggered by image URL inputs.
Since the vulnerability exploits outbound HTTP requests, you can detect suspicious activity by capturing and analyzing network traffic from the affected system, focusing on unexpected or unauthorized outbound requests.
Suggested commands to help detect such activity include:
- Using tcpdump to capture outbound HTTP requests: tcpdump -i <interface> 'tcp dst port 80 or 443'
- Using netstat to check established outbound connections: netstat -tnp | grep <fesod_process>
- Using curl or wget to test if the application fetches images from user-supplied URLs that point to internal resources.
Additionally, reviewing application logs for unusual URL fetch attempts or errors related to image fetching may help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate mitigation step is to upgrade Apache Fesod to version 2.0.2-incubating or later, as this version includes fixes that implement URL scheme policies, private-network checks, redirect limits, response size limits, and image-type validation to prevent SSRF attacks.
If upgrading immediately is not possible, consider restricting the application’s network access to prevent outbound requests to internal or sensitive network ranges.
Implement firewall rules or network segmentation to block unauthorized outbound HTTP requests from the application server.
Review and apply any configurable URL fetching policies available in the current version to limit allowed URL schemes and destinations.