PT-2026-22060 · Unknown · Terriajs-Server

Peter Hassall · Publicado 2026-02-26 · Atualizado 2026-03-04 · CVE-2026-27818

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TerriaJS-Server versions prior to 4.0.3

Description A validation flaw permits an attacker to proxy domains not explicitly listed in the proxyableDomains configuration. The validation process only verifies if a hostname ends with an allowed domain, which allows malicious domains to be proxied through the server. For example, if example.com is in proxyableDomains, maliciousexample.com could also be proxied. This bypasses proxy restrictions.

Recommendations Upgrade to version 4.0.3 to resolve the issue.

Exploit

Correção

RCE

SSRF

Enumeração de Fraquezas

CWE-20

CWE-918

Identificadores relacionados

CVE-2026-27818

GHSA-W789-49FC-V8HR

Produtos afetados

Terriajs-Server

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27818.json · Exploit
• https://github.com/TerriaJS/terriajs-server/security/advisories/GHSA-w789-49fc-v8hr · Aviso do Fabricante
• https://github.com/TerriaJS/terriajs-server · Nota
• https://github.com/TerriaJS/terriajs-server/commit/3aaa5d9717162b245ae4569232bbe7d8673c913f · Correção
• https://github.com/TerriaJS/terriajs-server/releases/tag/4.0.3 · Nota
• https://osv.dev/vulnerability/CVE-2026-27818 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w789-49fc-v8hr · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1rfmr3t/resumen_diario_de_vulnerabilidades_26022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1rfmr6l/resumen_diario_de_vulnerabilidades_26022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2027004249595367504 · Publicação no Twitter
• https://twitter.com/_cvereports/status/2027068723262038052 · Publicação no Twitter
• https://t.me/cveNotify/154210 · Publicação no Telegram
• https://t.me/CVEtracker/45800 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-27818 · Nota de Segurança