CVE-2023-27160
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
An SSRF vulnerability in forem up to v2022.11.11 allows an attacker to send a crafted POST request to the /articles/{id} endpoint, enabling access to network resources and sensitive information.
Risk Assessment
An attacker can exploit this vulnerability to scan internal networks, access sensitive data, or launch attacks against other internal systems.
Recommendation
Immediately update forem to the latest version and implement request validation and filtering mechanisms to prevent SSRF attacks.
Other vulnerabilities in forem
See all- CVE-2026-61696Medium
Forem before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c stores an unsanitized value from feedback_message[message] and renders it via raw() in the admin view when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser, potentially exposing sensitive in-page data, CSRF tokens, or performing administrative actions. The public FeedbackMessagesController accepts the report without authorization and previously allowed a submitted offender_id, making the vulnerable path reachable by an unauthenticated attacker.
- CVE-2026-48780High
Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments.
Original NVD description (English source)
forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request.