CVE-2026-111720
Received Received - Intake

Unauthenticated SSRF in Fish Island Backend via URL Fetch

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111720
EUVD
EUVD-2026-103012

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lhccong fish-island-backend 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated server-side request forgery (SSRF) in fish-island-backend. It allows remote attackers to make the server fetch attacker-controlled URLs via the url parameter in a GET request to /api/web/parse. The server uses OkHttp with redirect-following, enabling attackers to target internal hosts, loopback services, or cloud metadata endpoints. The response may leak page titles, meta descriptions, and favicons.

Detection Guidance

Check for unusual GET requests to /api/web/parse with a url parameter pointing to internal or external targets. Monitor server logs for OkHttp redirect-following behavior or unexpected outbound connections.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate sensitive data from internal services, or interact with cloud provider metadata endpoints to obtain credentials or other secrets. This could lead to unauthorized access, data breaches, or further compromise of internal infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Disable or restrict access to the /api/web/parse endpoint. Implement network-level controls to block outbound requests from the server. Update to a patched version of fish-island-backend if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart