Server-Side Request Forgery in AndyFactory Newspaper4k Image Extractor
CVE-2026-120416

6.9MEDIUM

Key Information:

Vendor

Andyfactory

Status
Newspaper4k
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120416?

A vulnerability has been identified in AndyFactory's Newspaper4k version up to 0.9.6, affecting the Article.parse function in the image_extractor.py component. This flaw allows an attacker to exploit server-side request forgery (SSRF), enabling potential malicious activities from a remote location. The issue can be effectively mitigated by updating to version 0.9.6.1, which includes a critical patch. The vendor has shown a proactive response by promptly releasing a fix to safeguard users against this vulnerability.

Affected Version(s)

newspaper4k 0.9.0

newspaper4k 0.9.1

newspaper4k 0.9.2

References

https://vuldb.com/vuln/429801
vdb-entrytechnical-description
https://vuldb.com/vuln/429801/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120416
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammedix88 (VulDB User)
VulDB CNA Team
.