PT-2026-55296 · Lobehub · Lobehub

George Chen · Publicado 2026-07-02 · Atualizado 2026-07-02 · CVE-2026-59095

Mitre

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-59095

Produtos afetados

Lobehub

Referências · 4

• 🔥 https://github.com/lobehub/lobehub/issues/16536 · Exploit
• https://github.com/lobehub/lobehub/pull/16601 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-59095 · Nota de Segurança
• https://vulncheck.com/advisories/lobechat-canary-18-ssrf-via-importfromurl-and-fetchimagefromurl · Nota