CVE-2026-41170
HighSummary
Squidex before version 7.23.0 has an SSRF vulnerability in the `RestoreController.PostRestoreJob` endpoint, which allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient without SSRF protection. A malicious or compromised admin can use this to probe internal services, access cloud metadata, or perform internal reconnaissance.
Risk Assessment
The risk includes potential access to sensitive internal resources by an administrator, which could lead to compromise of the entire infrastructure.
Recommendation
Upgrade Squidex to version 7.23.0, which contains the fix. Also monitor administrator activities and restrict restore functionality to trusted personnel only.
Other vulnerabilities in Squidex
See all- CVE-2026-41172High
Squidex is an open source headless content management system. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.
- CVE-2026-41171High
Squidex before version 7.23.0 has an SSRF vulnerability due to missing SSRF protection on the `Jint` HTTP client used by scripting engine functions. An authenticated low-privileged user can force the server to make arbitrary outbound HTTP requests to internal or attacker-controlled endpoints. This can lead to access to internal services and cloud metadata endpoints, potentially exposing credentials and enabling lateral movement.
Original NVD description (English source)
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" `HttpClient` without any SSRF protection. A malicious or compromised admin can use this endpoint to probe internal network services, access cloud metadata endpoints, or perform internal reconnaissance. The vulnerability is authenticated (Admin-only) but highly impactful, allowing potential access to sensitive internal resources. Version 7.23.0 contains a fix.