Unauthenticated Server-Side Request Forgery in Fish Island Backend by LHC Cong

CVE-2026-111720

What is CVE-2026-111720?

The Fish Island Backend application is susceptible to an unauthenticated server-side request forgery (SSRF) vulnerability due to a flaw in the handling of GET requests directed at the /api/web/parse endpoint. Attackers can exploit this vulnerability by supplying malicious URLs through the 'url' parameter, allowing them to make the server retrieve internal or sensitive resources. This exploitation enables access to various internal services, including loopback addresses and cloud metadata endpoints, potentially exposing sensitive information such as page titles and meta descriptions. The issue stems from the lack of proper validation and restrictions on the user-supplied URLs.

References