Server-Side Request Forgery in CrawlSEO by CrawlSEO

CVE-2026-115411

What is CVE-2026-115411?

CrawlSEO prior to version 0.2.4 is susceptible to a server-side request forgery (SSRF) vulnerability within its crawler engine. The isPrivateIp() function inadequately restricts access to specific reserved IP ranges, including those defined by RFC 6598 and RFC 6890, as well as certain IPv6 addresses. This oversight, coupled with the inability to pin validated addresses for outbound connections, allows an authenticated attacker to exploit this flaw. By adding a malicious domain resolving to an internal or restricted address and triggering a crawl, attackers can access internal services or cloud metadata endpoints (e.g., 169.254.169.254). The information extracted includes page titles, descriptions, headings, status codes, and links via the crawl results API, potentially leading to significant internal network reconnaissance and exposure.

References