Server-Side Request Forgery in Oqtane Framework Affects File Upload Functionality

CVE-2026-122008

What is CVE-2026-122008?

The Oqtane Framework prior to version 10.3.0 has a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs. This issue allows authenticated registered users to direct the server to retrieve arbitrary URLs using a user-defined url parameter without proper validation of the scheme, host, or IP address. Attackers could exploit this flaw to access sensitive internal resources, including cloud instance metadata services or management interfaces bound to localhost. The unauthorized access could lead to the exfiltration of sensitive internal data or provide insights into the internal network structure, including the enumeration of hosts and open ports.

References