CVE-2026-33182
HighSummary
Saloon to biblioteka PHP, która umożliwia użytkownikom budowanie integracji API i SDK. W wersjach przed 4.0.0, podczas budowania URL żądania, Saloon łączył bazowy URL łącznika z punktem końcowym żądania, co mogło prowadzić do wykorzystania podatności SSRF oraz wycieku danych uwierzytelniających do hosta kontrolowanego przez atakującego.
Risk Assessment
Organizacja może być narażona na ataki typu server-side request forgery (SSRF) oraz na wyciek danych uwierzytelniających, co może prowadzić do nieautoryzowanego dostępu do zasobów lub danych wrażliwych.
Recommendation
Zaleca się aktualizację biblioteki Saloon do wersji 4.0.0 lub nowszej, aby zablokować możliwość używania absolutnych URL w punktach końcowych żądań.
Related vulnerabilities
- CVE-2026-90898Critical
Bifrost registers MCP clients through its management API, where a stdio client is a command plus args that is started immediately upon client addition, with no MCP handshake required. Authentication is disabled by default (governance.auth_config.is_enabled=false), meaning every caller is treated as a local admin. A single unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
- CVE-2026-90703Critical
A vulnerability has been found in D-Link DWR-M921 1.1.52 in the system function of the file /boafrm/formDiskCreateShare. Manipulation of the folderpath argument leads to OS command injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used.
- CVE-2026-90702Critical
A flaw has been found in D-Link DWR-M921 1.1.52 in the system function of the file /boafrm/formDiskFormat. Manipulation of the partition argument causes OS command injection. The attack may be initiated remotely, and the exploit has been published and may be used.
- CVE-2026-90699Critical
A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-90693Critical
A flaw has been found in D-Link DIR-878 120B05 impacting the SetWan3Settings function of the WAN Settings component. Manipulation of the Primary/Secondary argument causes a stack-based buffer overflow. Remote exploitation of the attack is possible.
- CVE-2026-90692Critical
A vulnerability was detected in D-Link DIR-878 120B05 affecting the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. Manipulation of the IPv6Address/Hostname argument results in a stack-based buffer overflow. The attack may be launched remotely.
- CVE-2026-85192Critical
The Joomla Conditional Content extension (regularlabs.com) in versions < 8.0.0 allows authenticated, privileged remote code execution. Conditional Content Pro accepts inline PHP Condition Rules in article syntax, and in affected versions the PHP is passed to the Conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves the syntax, so publishing the article causes the code to run as the web-server process.
- CVE-2026-82787Critical
A missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication.
- CVE-2026-90680Critical
A stack-based buffer overflow vulnerability was discovered in D-Link DIR-823G version 1.0.2B05_20181207, in the strcpy function of /HNAP1/SetStaticRouteSettings (HNAP1 component). Manipulating the PAddress/SubnetMask/Gateway arguments triggers the overflow. The attack can be launched remotely.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
Original NVD description (English source)
Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix in version 4.0.0 is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis.