CVE-2026-54166

Received Received - Intake

SSRF via CSV Import in Shelf Platform

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted `fetch()` request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-54166

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Shelf platform before version 1.20.3. Authenticated users with the asset:import permission can manipulate the imageUrl parameter during CSV content import to make the server fetch data from attacker-controlled URLs. The validation for image URLs can be bypassed using techniques like image extensions, path keywords, domain matching, or redirect chains.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for outbound HTTP requests to unusual or internal IP addresses from the Shelf application. Check logs for CSV import operations with imageUrl parameters pointing to external domains. Use tools like tcpdump or Wireshark to capture requests originating from the application server.

Impact Analysis

An attacker could exploit this to access internal network services, cloud metadata endpoints, or arbitrary external hosts from the application's network. This may lead to unauthorized data access, internal service probing, or potential denial of service through memory exhaustion if large responses are buffered.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data exposure or access to sensitive systems, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately upgrade Shelf to version 1.20.3 or later to patch the SSRF vulnerability. Temporarily restrict the asset:import permission to trusted users only. Implement network-level controls to block outbound requests to internal IP ranges and cloud metadata endpoints from the application server.

Hi! I’m here to help you understand CVE-2026-54166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70