CVE-2026-19352
Received Received - Intake

Server-Side Request Forgery in LosslessCut

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19352
EUVD
EUVD-2026-54920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mifi lossless-cut to 3.69.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) issue in mifi lossless-cut up to version 3.69.0. It exists in the file src/main/httpServer.ts, specifically in the built-in HTTP API service. An attacker with local network access could manipulate requests to exploit this flaw, though the complexity is high and exploitation is difficult. A patch has been provided to address the issue.

Detection Guidance

Check if LosslessCut is running with the experimental CLI flag enabled by inspecting process arguments or logs. Monitor network traffic for unexpected outbound requests from the application, especially to localhost or internal addresses. Verify if the HTTP server is binding to unintended interfaces.

Impact Analysis

The impact is limited due to high attack complexity and prerequisites. An attacker would need access to your local network and would face difficulties exploiting this issue. The vulnerability could potentially allow unauthorized requests to be made from the affected system, but the patch mitigates this risk.

Compliance Impact

This vulnerability involves server-side request forgery (SSRF) in LosslessCut's HTTP API service, which could allow unauthorized network requests if exploited. While not directly impacting GDPR or HIPAA compliance, SSRF risks could lead to data exfiltration or unauthorized access to internal systems, potentially violating confidentiality requirements under these regulations. The vulnerability's high complexity and prerequisites reduce immediate risk but still warrant mitigation to maintain compliance.

Mitigation Strategies

Apply the provided patch commit 260802348955231442c4bae6c2d9d8ede947af0a to enforce Host and Origin header validation. Disable the experimental CLI flag if enabled. Restrict network access to the application's HTTP server to trusted local clients only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart