CVE-2026-72591
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability in Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.
Risk Assessment
An attacker can use the server to scan internal networks, access internal services, or make unauthorized requests on behalf of the server, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update Koito to the latest version if a patch is available. Additionally, restrict access to the endpoint and validate URLs, blocking requests to internal addresses.
Original NVD description (English source)
A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.