CVE-2026-71250
Received Received - Intake

Blind SSRF in Firefly III via Webhook Validation Bypass

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71250
EUVD
EUVD-2026-53323

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
firefly_iii firefly_iii *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Firefly III allows an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server due to improper filtering of IPv4 ranges. The validator resolves hostnames at validation time but the actual request resolves them again, enabling DNS rebinding attacks to bypass restrictions.

Detection Guidance

Check Firefly III logs for unusual webhook activity or outbound requests to localhost or private IP ranges. Monitor DNS rebinding attempts by reviewing DNS query logs for unexpected hostname resolutions.

Impact Analysis

An attacker could exploit this to send requests to internal services, potentially accessing sensitive data or triggering unintended actions. Since webhooks are off by default, the risk is limited to users who have explicitly enabled this feature.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Organizations using Firefly III may need to assess their compliance posture if this vulnerability is exploited.

Mitigation Strategies

Disable webhooks if not needed. Update Firefly III to the latest version. Restrict outbound network access to trusted destinations. Implement network-level controls to block requests to localhost or private IP ranges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart