Server-Side Request Forgery Vulnerability in Progress Sitefinity
CVE-2026-92931

8.8HIGH

Key Information:

Vendor

Progress Software
Status
@progress/sitefinity-nextjs-sdk
Vendor
CVE Published:
5 October 2026

What is CVE-2026-92931?

A vulnerability in the Progress @progress/sitefinity-nextjs-sdk npm package has been identified, where server-side request forgery (SSRF) can occur. This issue gives remote attackers the ability to send server-side requests to any host they control, leading to potential exposure of sensitive information. Users of affected versions should take immediate action to secure their systems and mitigate risks.

Affected Version(s)

@progress/sitefinity-nextjs-sdk 15.1.8326 < 15.4.8638

References

https://community.progress.com/s/article/Sitefinity-Criti...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.