Server-Side Request Forgery in O2OA General Module
CVE-2026-105438

5.3MEDIUM

Key Information:

Vendor

O2OA

Status
O2oa
Vendor
CVE Published:
5 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105438?

A vulnerability has been identified in the O2OA General Module, specifically in the action function responsible for uploading Excel files through a URL. This issue revolves around improper validation of the 'fileUrl' parameter, which could be exploited to carry out a server-side request forgery (SSRF) attack. This type of attack allows unauthorized users to send requests from the vulnerable server, potentially accessing sensitive internal resources. The vulnerability affects versions of O2OA up to 10.0.1-ce, and despite prior notification of the issue, the vendor has not taken any remedial measures as of now. Remote attackers may leverage this flaw, making it critical for users to review their security posture urgently.

Affected Version(s)

O2OA 10.0.1-ce

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105438 - Proof of Concept

References

https://vuldb.com/vuln/413603
vdb-entrytechnical-description
https://vuldb.com/vuln/413603/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105438
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

rockmelodeis (VulDB User)
VulDB CNA Team
.