CVE-2026-48053
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.
Risk Assessment
An attacker can exploit the unauthenticated endpoint to read sensitive data or perform SSRF attacks, potentially leading to confidentiality and integrity breaches in the organization.
Recommendation
It is recommended to immediately upgrade Kolibri to version 0.19.4 or later to eliminate the vulnerability.
Other vulnerabilities in Kolibri
See all- CVE-2014-4158High
Kolibri 2.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long URI in a GET request.
- CVE-2010-5301High
Kolibri 2.0 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long URI in a HEAD request.
Original NVD description (English source)
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS