CVE-2026-82667
Received Received - Intake

Server-Side Request Forgery in GEOFlow up to 2.1.0

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpoint_url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.1 is recommended to address this issue. The name of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82667
EUVD
EUVD-2026-68436

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yaojingang geoflow to 2.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) in GEOFlow up to version 2.1.0. It exists in the DistributionController.isValidHttpEndpoint function due to improper validation of the endpoint_url argument. An attacker can manipulate this input to force the server to make unauthorized requests, potentially accessing internal resources.

Detection Guidance

Detecting this vulnerability requires checking for the presence of GEOFlow versions up to 2.1.0. Inspect the installed version of GEOFlow by examining the file app/Services/GeoFlow/GenericHttpEndpointResolver.php or running version-specific commands if available. Monitor network traffic for unusual outbound requests that may indicate server-side request forgery attempts.

Impact Analysis

An attacker could exploit this to send crafted requests from your server to internal or external systems. This may lead to data leaks, unauthorized access to sensitive services, or further attacks against internal infrastructure. The impact depends on the server's network configuration and permissions.

Mitigation Strategies

Immediately upgrade GEOFlow to version 2.1.1 or later. Apply the patch identified as 67abfd864a15d169a78429f3290c91cb3b93e849. If immediate upgrade is not possible, restrict access to the DistributionController.isValidHttpEndpoint function or implement network-level controls to block suspicious outbound requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart