Server-Side Request Forgery in OWL's DocumentProcessingToolkit
CVE-2026-85675

8.7HIGH

Key Information:

Vendor

Camel-ai

Status
Owl
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85675?

The DocumentProcessingToolkit from OWL contains a vulnerability that allows attackers to exploit server-side request forgery. This flaw exists in the extract_document_content feature, which can inadvertently request external resources from URLs provided by users without adequate validation for schemes, hosts, or IP addresses. By leveraging prompt injection techniques, an attacker can manipulate the toolkit to reach sensitive internal resources, posing a significant security risk.

Affected Version(s)

owl 0

References

https://github.com/camel-ai/owl/issues/615
issue-tracking
https://github.com/camel-ai/owl
product
https://github.com/camel-ai/owl/blob/fba1dd5b3a9e8cc15f16...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.