CVE-2026-86119
Received Received - Intake

Unauthenticated SSRF in Webstudio via Proxy Routes

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86119
EUVD
EUVD-2026-71951

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webstudio webstudio 0.296.0
webstudio is webstudio

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Webstudio versions up to 0.296.0. It affects the /cgi/image, /cgi/video, and /cgi/asset proxy routes when the RESIZE_ORIGIN environment variable is not set. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.

Detection Guidance

Check if the RESIZE_ORIGIN environment variable is unset in your Webstudio deployment. Test the affected routes (/cgi/image, /cgi/video, /cgi/asset) by sending requests with arbitrary URLs to see if the server fetches external or internal resources without validation.

Impact Analysis

An attacker could exploit this to read sensitive cloud metadata, access internal services, scan internal networks, or steal credentials and secrets. The hosted SaaS version is not affected as it sets RESIZE_ORIGIN.

Mitigation Strategies

Upgrade Webstudio to a version where RESIZE_ORIGIN is set by default or implement strict URL validation for the affected routes. Block private/internal IP ranges and restrict allowed schemes to HTTP/HTTPS. Remove reliance on the Referer header for access control.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart