CVE-2026-82081
Received Received - Intake

SSRF in wallabag via PDF Export

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MITRE

Description
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-82081
EUVD
EUVD-2026-67400

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wallabag wallabag to 2.6.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82081 is a Server-Side Request Forgery (SSRF) vulnerability in wallabag versions 2 through 2.6.14. It occurs because article titles or content fields containing malicious payloads are not properly sanitized before being processed during PDF export. This allows an attacker to craft inputs that trick the server into making unauthorized requests to internal or external systems.

Detection Guidance

To detect this vulnerability, inspect Wallabag entries for unusual titles or content containing external URLs or scripts. Check PDF export logs for unexpected outbound requests to internal or external addresses. Use network monitoring tools like tcpdump or Wireshark to capture outbound connections initiated by the Wallabag server during PDF generation.

Impact Analysis

An authenticated attacker could exploit this to perform SSRF attacks, potentially accessing internal network resources, reading local files, or interacting with cloud services like IMDSv1. This could lead to data breaches, session hijacking, or account takeover if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected wallabag versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Wallabag to the latest version if available. Apply input sanitization patches for title and content fields. Disable PDF export functionality temporarily if no patch is available. Restrict network access for the Wallabag server to prevent SSRF from reaching internal resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart