CVE-2026-41172
HighSummary
Squidex is an open source headless content management system. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.
Risk Assessment
The vulnerability allows an attacker to access internal network resources, potentially leading to disclosure of sensitive information or further attacks.
Recommendation
Upgrade Squidex to version 7.23.0 or later and restrict asset upload permissions.
Other vulnerabilities in Squidex
See all- CVE-2026-41171High
Squidex before version 7.23.0 has an SSRF vulnerability due to missing SSRF protection on the `Jint` HTTP client used by scripting engine functions. An authenticated low-privileged user can force the server to make arbitrary outbound HTTP requests to internal or attacker-controlled endpoints. This can lead to access to internal services and cloud metadata endpoints, potentially exposing credentials and enabling lateral movement.
- CVE-2026-41170High
Squidex before version 7.23.0 has an SSRF vulnerability in the `RestoreController.PostRestoreJob` endpoint, which allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient without SSRF protection. A malicious or compromised admin can use this to probe internal services, access cloud metadata, or perform internal reconnaissance.
Original NVD description (English source)
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.