Blind Server-Side Request Forgery Vulnerability in Squidex CMS
CVE-2026-41177
Key Information:
Badges
What is CVE-2026-41177?
Squidex, an open-source headless content management system, suffers from a vulnerability in its Restore API prior to version 7.23.0. The flaw arises from insufficient validation of the URI scheme within the user-supplied 'Url' parameter. This oversight permits an authenticated administrator to exploit the application using the 'file://' protocol, which can lead to malicious interactions with the backend server's local filesystem. Such actions have the potential to initiate Local File Interaction (LFI), ultimately enabling attackers to disclose sensitive information through side-channel analysis of internal logs. Users are advised to update to version 7.23.0 or later to mitigate this risk.
Affected Version(s)
squidex < 7.23.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.