CVE-2026-108770

Received Received - Intake

Server-Side Request Forgery in Appwrite Avatars Service

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulDB

Description

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-11

Last Modified

2026-10-11

Generated

2026-10-12

AI Q&A

2026-10-12

EPSS Evaluated

N/A

NVD

CVE-2026-108770

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	Appwrite	2.0
n/a	Appwrite	2.1
n/a	Appwrite	2.2
n/a	Appwrite	2.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Appwrite versions up to 2.3.0. It exists in the PublicHostname function of the Browser Screenshot Service component. An attacker can manipulate the url argument to force the server to make unauthorized requests.

Detection Guidance

This vulnerability is specific to Appwrite versions up to 2.3.0 and involves a server-side request forgery in the Browser Screenshot Service. Detection involves checking the Appwrite version and inspecting the affected file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php for the PublicHostname function.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate data, or perform unauthorized actions on behalf of the server. This could lead to data breaches, service disruption, or further network compromise depending on the server's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Appwrite to version 2.4.0 or later to resolve the issue. The patch is identified as 393255e7302ae5503331d45802e2eee01c6a47fe.

Hi! I’m here to help you understand CVE-2026-108770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70