CVE-2026-44583

Received Received - Intake

Blind SSRF via Unvalidated PayPal-CERT-URL Header in Paymenter

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations. This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage. As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations. This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints. Depending on network configuration, this may lead to: blind SSRF to external attacker-controlled systems, and potential access to internal network services No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels. This issue has been fixed in version 1.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-44583

Affected Vendors & Products

Vendor	Product	Version / Range
paymenter	paymenter	to 1.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects Paymenter, a webshop solution for hosting services. In versions before 1.5.0, the PayPal webhook endpoint processes the PAYPAL-CERT-URL HTTP header without validation. Attackers can manipulate this header to control server-side HTTP requests made via file_get_contents. This leads to blind SSRF, allowing attackers to probe internal networks or trigger requests to external systems without receiving direct responses.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected outbound HTTP requests originating from the Paymenter application, particularly to external or internal endpoints. Check server logs for unusual file_get_contents calls or requests to the /extensions/paypal/webhook endpoint with a PAYPAL-CERT-URL header containing suspicious URLs.

Impact Analysis

If you use Paymenter versions prior to 1.5.0, attackers could exploit this to make your server send HTTP requests to arbitrary internal or external endpoints. This may enable network probing, data exfiltration via side channels, or access to sensitive internal services. The impact depends on your network configuration and whether internal services are exposed.

Compliance Impact

This vulnerability could lead to unauthorized network access or data exfiltration, which may violate GDPR (data protection) or HIPAA (health data privacy) if sensitive data is exposed. Compliance risks include breaches of confidentiality, integrity, or availability requirements, depending on the data processed by the affected system.

Mitigation Strategies

Upgrade Paymenter to version 1.5.0 or later immediately. If upgrading is not possible, implement strict validation for the PAYPAL-CERT-URL header to ensure it only points to trusted, allowlisted endpoints. Disable or restrict outbound HTTP requests from the application until the fix is applied.

Hi! I’m here to help you understand CVE-2026-44583. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70