Server-Side Request Forgery in Mediary Scout by Fancy Dirty
CVE-2026-125359

5.3MEDIUM

Key Information:

Vendor

Fancydirty

Status
Mediary-scout
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125359?

Mediary Scout prior to the release on November 5, 2026 features a server-side request forgery vulnerability that permits any authenticated user to set an arbitrary PanSou base URL without proper role validation. By invoking the savePanSouBaseUrlAction, attackers can exploit this flaw to trigger internal server-side POST requests through the probePanSou() method, enabling them to discover internal services and ports by analyzing distinct error responses. This vulnerability poses significant risks as it allows unauthorized users to manipulate server requests and could potentially lead to deeper exploitation of the server environment.

Affected Version(s)

mediary-scout 0 < 2026.11.05

References

https://github.com/fancydirty/mediary-scout/issues/366
issue-tracking
https://github.com/fancydirty/mediary-scout
product
https://github.com/fancydirty/mediary-scout/blob/v2026.10...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.