← voltar
CVE-2026-47170

Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint

CVSS 7.7 HIGHEPSS 0.2%CWE-918
Vexday Risk Score
21Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 7.7EPSS 0.2%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
11 jun 2026Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N