Server-Side Request Forgery Vulnerability in Apache Fesod Sheet
CVE-2026-107460

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Fesod (incubating)
Vendor
CVE Published:
13 October 2026

What is CVE-2026-107460?

The UrlImageConverter component in Apache Fesod (Incubating) has a vulnerability that allows Server-Side Request Forgery (SSRF) attacks via DNS rebinding. By exploiting this flaw, an attacker can craft image URLs that, when processed, may resolve to internal network resources, bypassing the intended security measures. Users are advised to upgrade to version 2.1.0-incubating, which mitigates these risks by disabling remote URL image fetching by default and requiring a strict allowlist for secure operation. It is crucial for applications enabling this feature to trust only verified hostnames to prevent malicious exploits.

Affected Version(s)

Apache Fesod (Incubating) 2.0.2-incubating

References

https://github.com/apache/fesod/pull/1035
patch
https://github.com/apache/fesod/releases/tag/2.1.0-incuba...
release-notes
https://cve.org/CVERecord?id=CVE-2026-49328
related

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Venkatraman Kumar
Wenhao Zeng
Wanxin Yin
George Chen
Zeka Irving (Thresh)
.