Server-Side Request Forgery in ptbsare anx-calibre-manager Product

CVE-2026-112297

What is CVE-2026-112297?

A vulnerability has been identified in the ptbsare anx-calibre-manager product where a flaw in the LLMClient.chat function, located in the LLM Configuration Handler's llm.py file, allows for remote initiation of server-side request forgery attacks. By manipulating the base_url argument, an attacker could exploit this vulnerability, potentially allowing them to make unauthorized requests to internal systems. This issue poses significant risks for users of the software, especially given that the vendor has not responded to disclosures about the vulnerability.

References