Server-Side Request Forgery Vulnerability in Buku by Jarun
CVE-2026-123201

6.3MEDIUM

Key Information:

Vendor: Jarun
Status: Buku
Vendor: CVE Published:; 5 November 2026

What is CVE-2026-123201?

Buku version 5.1.1 is vulnerable to a Server-Side Request Forgery (SSRF) that allows remote attackers to make internal server requests by manipulating the 'url' parameter in the /api/fetch_data or /api/network_handle endpoints. This vulnerability can be exploited to access loopback addresses, private IP ranges, or cloud service metadata. By bypassing the inadequate is_bad_url() check and following redirects, attackers can uncover sensitive internal services and extract informational content such as titles, descriptions, and keywords.