SSRF Vulnerability in Wallabag 2 Product by Wallabag
CVE-2026-82081

6.4MEDIUM

Key Information:

Vendor

Wallabag

Status
Wallabag
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82081?

The vulnerability in Wallabag 2 versions up to 2.6.14 allows for Server Side Request Forgery (SSRF) due to improper handling of crafted input in the title or content fields during the PDF export process. This can potentially expose sensitive data and server resources, allowing attackers to manipulate server requests and access internal systems without proper authorization.

Affected Version(s)

wallabag 2.0.0 <= 2.6.14

References

https://github.com/wallabag/wallabag/security/advisories/...
issue-trackingthird-party-advisory
https://github.com/FUNFACTOR1/WALLABAG-FULL-DISCLOSURE-St...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.