CVE-2026-19770
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability was identified in fm-mcp-servers version 0.0.3, affecting the downloadReport function in src/smadex-reporting/src/index.ts. Manipulation of the downloadUrl argument leads to server-side request forgery (SSRF). The attack can only be performed from a local environment.
Risk Assessment
Risk of using the server to send requests to internal resources, potentially leading to data exposure or attacks on other systems.
Recommendation
The project has not responded; it is recommended to monitor for updates and consider temporary mitigations, such as restricting access to the endpoint.
Original NVD description (English source)
A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.