Server-Side Request Forgery Vulnerability in Dmitryglhf MCP-URL-Downloader
CVE-2026-7158

6.9MEDIUM

Key Information:

Vendor

Dmitryglhf

Status
Mcp-url-downloader
Vendor
CVE Published:
27 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7158?

A vulnerability exists in the dmitryglhf MCP-URL-Downloader that allows for server-side request forgery due to improper validation of URLs in the _validate_url_safe function. This issue can be exploited remotely, allowing attackers to manipulate the URL argument and potentially access sensitive data or services on the server. Despite being reported, the vendor has yet to provide a response or patch. Given the rolling release model of the product, precise version details for affected or updated software are unavailable, emphasizing the urgency for users to be aware of this risk.

Affected Version(s)

mcp-url-downloader 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7158 - Proof of Concept

References

https://vuldb.com/vuln/359757
vdb-entrytechnical-description
https://vuldb.com/vuln/359757/cti
signaturepermissions-required
https://vuldb.com/submit/802062
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

SmallW (VulDB User)
VulDB CNA Team
.