CVE-2026-72597

MediumCVSS 6.5

Published: 11/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

Server-side request forgery vulnerability in Friendica through the 2026.08-dev branch. Authenticated users with a free self-registered account can probe internal network services via the link-preview endpoint, which fetches any user-supplied URL without applying an internal IP deny list.

Risk Assessment

An attacker can scan the internal network or access cloud metadata services, potentially leading to information disclosure or further attacks.

Recommendation

Update Friendica to a fixed version. Apply an internal IP deny list to the link-preview endpoint.

Other vulnerabilities in Friendica

CVE-2026-72550Critical
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query, enabling stacked statement injection.

Original NVD description (English source)

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS