SSRF Vulnerability in Open edX Platform Affecting User-Submitted URLs

CVE-2026-55421

What is CVE-2026-55421?

The Open edX Platform, which facilitates the creation and delivery of online learning content, has a vulnerability that allows server-side request forgery (SSRF) through user-supplied file URLs. An attacker can exploit this flaw to manipulate server behavior by supplying malicious URLs, resulting in unauthorized access or data exfiltration. The vulnerability existed prior to commit 00b7c3c but has since been addressed. Notably, the flaw's exploitability arose from the lack of a fetch timeout and follow-redirection policy which enabled potential data leaks.

References