Stored URL Injection Vulnerability in Endatix Form Management Platform

CVE-2026-61529

What is CVE-2026-61529?

The Endatix platform, prior to version 0.7.0, is susceptible to a stored URL injection vulnerability via its anonymous submission endpoint. Attackers can exploit this flaw by injecting malicious URLs into the JsonData field, which gets stored without adequate validation of the URL's integrity. When a staff member retrieves submissions, the application fetches the URL without checking its validity against internal networks. This can lead to unauthorized access to internal services, loopback addresses, and cloud metadata, allowing potential data exposure. Users should upgrade to version 0.7.0 to mitigate this risk.

References