Blind Server-Side Request Forgery Vulnerability in Squidex CMS
CVE-2026-41177

5.5MEDIUM

Key Information:

Vendor

Squidex

Status
Squidex
Vendor
CVE Published:
22 April 2026

What is CVE-2026-41177?

Squidex, an open-source headless content management system, suffers from a vulnerability in its Restore API prior to version 7.23.0. The flaw arises from insufficient validation of the URI scheme within the user-supplied 'Url' parameter. This oversight permits an authenticated administrator to exploit the application using the 'file://' protocol, which can lead to malicious interactions with the backend server's local filesystem. Such actions have the potential to initiate Local File Interaction (LFI), ultimately enabling attackers to disclose sensitive information through side-channel analysis of internal logs. Users are advised to update to version 7.23.0 or later to mitigate this risk.

Affected Version(s)

squidex < 7.23.0

References

https://github.com/Squidex/squidex/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.