Server-Side Request Forgery Vulnerability in Appwrite's Browser Screenshot Service
CVE-2026-108770

6.9MEDIUM

Key Information:

Vendor

Appwrite

Status
Appwrite
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108770?

A security weakness has been discovered in Appwrite's Browser Screenshot Service, specifically in the PublicHostname function of the Get.php file. This vulnerability allows an attacker to manipulate the URL argument, leading to remote server-side request forgery (SSRF). Successful exploitation could enable malicious actors to perform unauthorized requests on behalf of the server, potentially leading to data leakage or further compromise. Users are strongly advised to upgrade to version 2.4.0 or later to mitigate this issue and apply the necessary patches.

Affected Version(s)

Appwrite 2.0

Appwrite 2.1

Appwrite 2.2

References

https://vuldb.com/vuln/416552
vdb-entrytechnical-description
https://vuldb.com/vuln/416552/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108770
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zeo666666 (VulDB User)
.