Server-Side Request Forgery in dfm feedfinder2 Product by DFM
CVE-2026-118586

6.9MEDIUM

Key Information:

Vendor

Dfm

Status
Feedfinder2
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118586?

A security flaw has been identified in the dfm feedfinder2 product, specifically in the function find_feeds located in the feedfinder2.py file. This vulnerability allows for server-side request forgery, making it possible for an attacker to manipulate requests sent from the server, potentially leading to unauthorized access to data or services. Despite being reported early to the project team, there has been no response to address this critical issue, leaving users vulnerable to remote exploitation.

Affected Version(s)

feedfinder2 0.0.1

feedfinder2 0.0.2

feedfinder2 0.0.3

References

https://vuldb.com/vuln/428026
vdb-entrytechnical-description
https://vuldb.com/vuln/428026/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-118586
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammedix88 (VulDB User)
VulDB CNA Team
.