← volver
CVE-2026-47170

Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint

CVSS 7.7 HIGHEPSS 0.2%CWE-918
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.7EPSS 0.2%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
11 jun 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
garlic-signage · garlic-hub