Server-Side Request Forgery in Property URL Importer of agit8or1 Clientst0r
CVE-2026-112254

5.3MEDIUM

Key Information:

Vendor

Agit8or1

Status
Clientst0r
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112254?

A vulnerability has been identified in the Property URL Importer component of the agit8or1 Clientst0r software, specifically within the _fetch_html function located in locations/services/property_url_importer.py. This flaw enables remote attackers to manipulate the URL argument, leading to a server-side request forgery (SSRF) condition. Such an exploit allows attackers to make the server issue arbitrary requests, potentially exposing sensitive internal resources. Affected users are advised to upgrade to version 3.17.587 to mitigate this risk. The vendor responded promptly to reports and successfully released a patch addressing this vulnerability.

Affected Version(s)

clientst0r 3.17.586

clientst0r 3.17.587

References

https://vuldb.com/vuln/422335
vdb-entrytechnical-description
https://vuldb.com/vuln/422335/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112254
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Plus0ne_27 (VulDB User)
VulDB CNA Team
.