CVE-2026-54166

HighCVSS 7.1

Published: 11/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

In Shelf, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation can be bypassed via image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains, resulting in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, response bodies are fully buffered before size validation, creating a memory exhaustion vector.

Risk Assessment

An attacker can reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. This may lead to credential leakage and server resource exhaustion.

Recommendation

Update Shelf to version 1.20.3 or later. Restrict the asset:import permission and consider blocking outbound HTTP traffic to internal networks and metadata endpoints.

Other vulnerabilities in Shelf

CVE-2026-47697High
Shelf prior to version 1.20.2 has an IDOR vulnerability that allows an authenticated user from organization A to access data of organization B by manipulating entity IDs. Additionally, booking restrictions can be bypassed via a crafted POST request.

Original NVD description (English source)

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted `fetch()` request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS