CVE-2026-86119

HighCVSS 8.6

Published: 05/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

45th percentile - higher than 45% of all known CVEs

Summary

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.

Risk Assessment

The risk includes unauthorized access to sensitive cloud data and internal services, potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to set the RESIZE_ORIGIN environment variable and restrict access to the proxy routes, as well as update Webstudio to the latest version once a patch is available.

Other vulnerabilities in Webstudio

CVE-2026-113596Low
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS