CVE-2026-82081
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
wallabag versions 2 through 2.6.14 are vulnerable to SSRF because a crafted title or content field is mishandled during PDF export.
Risk Assessment
An attacker can exploit this vulnerability to make HTTP requests from the server, potentially accessing internal network resources or other systems.
Recommendation
Upgrade wallabag to the latest available version that contains the fix for this vulnerability.
Other vulnerabilities in wallabag
See all- CVE-2026-82089High
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
- CVE-2023-4455Medium
A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository wallabag/wallabag prior to version 2.6.3. This allows attackers to send unauthorized requests on behalf of users.
- CVE-2023-4454Medium
A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository wallabag/wallabag prior to version 2.6.3. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
Original NVD description (English source)
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.