CVE-2026-76795 AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery
Remote attackers can exploit a server-side request forgery vulnerability in the PullMD REST API to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76795?
CVE-2026-76795 is a medium-severity server-side request forgery vulnerability in AeternaLabsHQ PullMD, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.
Weakness: CWE-918
Which versions are affected by CVE-2026-76795?
How do I fix CVE-2026-76795?
No fix has been published for CVE-2026-76795 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-76795 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76795 exists.
Sources
Also known as GHSA-p53p-vh92-qhpp.