CVE-2026-110223
Awaiting Analysis Awaiting Analysis - Queue

Kavita SSRF Bypass via DNS Rebinding or HTTPS Redirects

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-14
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110223
EUVD
EUVD-2026-99008

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Kareadita Kavita 0.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kavita versions 0.9.0 through 0.9.1.4 have a server-side request forgery (SSRF) vulnerability. Authenticated users can bypass the SSRF blocklist by using DNS rebinding or HTTPS redirects. This allows attackers to submit a URL to POST /api/Cbl/upload-cbl-file that initially appears valid but later redirects or rebinds to internal addresses. This enables probing of internal ports and services without direct access.

Detection Guidance

Detecting this SSRF vulnerability requires monitoring network traffic for unusual DNS rebinding or HTTPS redirects. Check Kavita server logs for POST requests to /api/Cbl/upload-cbl-file with suspicious URLs. Use tools like tcpdump or Wireshark to inspect traffic for internal IP probes after external URL validation.

Impact Analysis

If you use a vulnerable version of Kavita, an attacker with authenticated access could exploit this to probe internal systems, potentially discovering sensitive services or ports. This could lead to further attacks, data breaches, or unauthorized access to internal resources.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data involved. Organizations must address this to maintain compliance.

Mitigation Strategies

Upgrade Kavita to a version beyond 0.9.1.4. Disable or restrict access to the /api/Cbl/upload-cbl-file endpoint. Implement strict URL validation to block DNS rebinding and HTTPS redirects. Monitor network traffic for internal port probing attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart