CVE-2026-15974

Awaiting Analysis Awaiting Analysis - Queue

SSRF and Local File Read in SGLang via Image URL

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: CERT/CC

Description

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-15974

EUVD

EUVD-2026-51263

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

SGLang has a vulnerability in its multimodal generation endpoint /v1/chat/completions where unsanitized image_url parameters allow Server-Side Request Forgery (SSRF) and local file reads. This means attackers can access internal services, metadata, and sensitive files on the server.

Detection Guidance

I don't know

Monitor network traffic for unsanitized requests to /v1/chat/completions with image_url parameters. Check logs for unusual file reads or internal service access attempts.

Impact Analysis

This vulnerability could allow attackers to read sensitive files on your server, access internal services, or exfiltrate confidential data. If exploited, it may lead to data breaches, unauthorized access, or service disruption.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data or HIPAA by leaking protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to unauthorized data access.

Mitigation Strategies

Disable the /v1/chat/completions endpoint if not in use. Implement strict input validation for image_url parameters. Restrict internal network access to this service.

Hi! I’m here to help you understand CVE-2026-15974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70