CVE-2026-18359

Analyzed Analyzed - Analysis Complete

Server-Side Request Forgery in eScriptorium

Publication date: 2026-08-06

Last updated on: 2026-08-18

Assigner: GitLab Inc.

Description

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-18

Generated

2026-08-26

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-25

NVD

CVE-2026-18359

EUVD

EUVD-2026-54091

Affected Vendors & Products

Vendor	Product	Version / Range
escriptorium	escriptorium	to 26.04.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in Scripta eScriptorium through version 26.04.1. It allows a remote authenticated user to trick the server into making arbitrary HTTP requests to internal hosts, including the cloud instance metadata service. This occurs via the mets_uri or iiif_uri parameter in a POST request to /api/documents/{pk}/imports/ because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' with no address filtering, redirect limits, or timeout applied.

Detection Guidance

Check server logs for unusual POST requests to /api/documents/{pk}/imports/ with mets_uri or iiif_uri parameters pointing to internal hosts or metadata services. Monitor network traffic for outbound requests from the server to unexpected destinations.

Impact Analysis

An attacker could exploit this to access internal services, exfiltrate sensitive data, or interact with cloud metadata services. This may lead to unauthorized data access, service disruption, or further attacks on internal systems if the server has access to restricted networks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data or systems, potentially breaching GDPR (data protection) or HIPAA (health data privacy) if such data is exposed or compromised through the SSRF attack.

Mitigation Strategies

Disable the default wildcard setting for IMPORT_ALLOWED_DOMAINS and restrict it to only trusted domains. Implement strict input validation for mets_uri and iiif_uri parameters. Apply network-level restrictions to block outbound requests to internal hosts or metadata services.

Hi! I’m here to help you understand CVE-2026-18359. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70