Server-Side Request Forgery Vulnerability in Page Replica by Page-Replica
CVE-2026-4907
Key Information:
- Vendor
Page-replica
- Status
- Vendor
- CVE Published:
- 27 March 2026
Badges
What is CVE-2026-4907?
A server-side request forgery (SSRF) vulnerability has been discovered in Page Replica, specifically within the sitemap.fetch function of the Endpoint component. This flaw can be exploited by manipulating the argument 'url', allowing attackers to send requests from the server to unintended locations. As the attack is remotely executable, it poses a significant risk. The vendor has not responded to inquiries regarding this issue, and public exploits are already available. Users are advised to remain vigilant and monitor for updates, given the product’s rolling release strategy, which complicates version tracking for necessary security improvements.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Page Replica e4a7f52e75093ee318b4d5a9a9db6751050d2ad0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved