Server-Side Request Forgery Vulnerability in Apache Fesod
CVE-2026-49328

5.3MEDIUM

Key Information:

Vendor: Apache
Status: Apache Fesod (incubating)
Vendor: CVE Published:; 1 June 2026

What is CVE-2026-49328?

The vulnerability in the UrlImageConverter component of Apache Fesod before version 2.0.2-incubating allows attackers to exploit server-side request forgery. By supplying a malicious image URL, an attacker could trigger outbound network requests to internal or otherwise restricted resources, creating potential exposure to sensitive data. Users are encouraged to update to version 2.0.2-incubating to mitigate this risk.