CVE-2026-122008 Oqtane Framework before 10.3.0 SSRF via File Upload From URL
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122008?
CVE-2026-122008 is a medium-severity vulnerability in oqtane.framework, published on 4 Nov 2026.
Official description
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.
Weakness: CWE-918
Which versions are affected by CVE-2026-122008?
How do I fix CVE-2026-122008?
No fix has been published for CVE-2026-122008 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122008 being exploited?
There is no known exploitation of CVE-2026-122008 in the wild and no public exploit code.
Sources
Also known as GHSA-p838-xx56-rf99.