{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-61529 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-61529 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-61529 is a medium-severity vulnerability in endatix, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-61529 and fix it if it is affected.\n\nWhat it is: CVE-2026-61529 is a medium-severity vulnerability in endatix, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-61529 in the wild and no public exploit code.\n\nAffected product: endatix. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-61529/ (Markdown: https://insights.sbomify.com/CVE-2026-61529/index.md)","id":"CVE-2026-61529","markdown":"https://insights.sbomify.com/CVE-2026-61529/index.md","name":"CVE-2026-61529","record":{"aliases":["GHSA-jw28-j36r-gp9m"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":4.7,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"description":"Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object with `name`, `type` and `content` fields can contain an HTTP or HTTPS URL. When a staff member with `submissions.view` permission invokes `POST /forms/{formId}/submissions/{submissionId}/files`, `GetFilesHandler` passes the stored data to `SubmissionFileExtractor` in `src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs`, which calls `HttpClient.GetAsync` without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services, cloud metadata, loopback and link-local addresses from the server's network position. The form must have `IsPublic` and `IsEnabled` set, and an anonymous submission must pass reCAPTCHA v3 when configured. The fetched response is placed in the staff viewer's ZIP, not returned directly to the attacker, so disclosure to the attacker is blind or indirect through observable request behavior or information exposed by the viewer. No integrity or availability impact is asserted; data: and raw-base64 `content` are decoded locally without network requests. This issue is fixed in version 0.7.0.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)","id":"CVE-2026-61529","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"Yayson: Prototype pollution in the Store/LegacyStore deserialization","id":"CVE-2026-61534"},"packages":[],"prev":{"headline":"AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler","id":"CVE-2026-61526"},"products":["endatix"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-29","vendors":["endatix"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-61529/"}