SSRF Vulnerability in Event Schedule Platform by Event Schedule

CVE-2026-55190

What is CVE-2026-55190?

Event Schedule is an open-source platform designed for event sharing and ticket sales. In versions up to 1.0.0, a security gap exists in the App\Utils\UrlUtils::isUrlSafe() function, which serves as a guard against SSRF attacks on user-supplied import URLs. This vulnerability can be exploited, enabling attackers to access internal or localhost services when URLs are fetched by ImportCuratorEvents, specifically during the parsing of response bodies and image URLs. As of now, there are no publicly available patches to address this issue, leaving users and their data at risk.

References