Security Flaw in Firefly III's Webhook URL Validator
CVE-2026-71250

4.3MEDIUM

Key Information:

Vendor

Firefly-iii

Status
Firefly-iii
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71250?

The webhook URL validator in Firefly III is susceptible to a security flaw that allows authenticated users to configure webhooks that target loopback services on the server. Although designed to filter private IP addresses, the validator incorrectly permits addresses within the loopback range (127.0.0.0/8) due to an early-return condition. Additionally, a DNS-rebinding attacker can bypass validation by resolving a public IP at validation time while sending a request to an internal address, exploiting the system to potentially access sensitive services concealed within the network. Notably, the response from these webhooks is only logged server-side, creating a blind Server-Side Request Forgery (SSRF) vulnerability without direct feedback to the user.

Affected Version(s)

firefly-iii 0

References

https://github.com/firefly-iii/firefly-iii

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.