CVE-2026-41170 Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
An administrator can exploit the backup restore endpoint to perform Server-Side Request Forgery, accessing internal network resources or cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41170?
CVE-2026-41170 is a high-severity server-side request forgery vulnerability in squidex, published on 22 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" `HttpClient` without any SSRF protection. A malicious or compromised admin can use this endpoint to probe internal network services, access cloud metadata endpoints, or perform internal reconnaissance. The vulnerability is authenticated (Admin-only) but highly impactful, allowing potential access to sensitive internal resources. Version 7.23.0 contains a fix.
Weakness: CWE-918
Which versions are affected by CVE-2026-41170?
How do I fix CVE-2026-41170?
No fix has been published for CVE-2026-41170 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-41170 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41170 exists.
Sources
Also known as GHSA-6q6m-7h5j-jq4g.