PT-2026-20327 · Cern · Indico

Inkz + 2 · Published 2026-02-17 · Updated 2026-02-26 · CVE-2026-25738

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.10

Description Indico, an event management system, is susceptible to server-side request forgery (SSRF). The system makes outgoing requests to URLs provided by users. While this functionality is intentional, it could allow access to sensitive targets like localhost or cloud metadata endpoints. The risk is limited to event organizers who can access endpoints where SSRF could be used to view returned data. Users hosted on AWS without authentication for sensitive data are less affected.

Recommendations Versions prior to 3.3.10 should be upgraded to version 3.3.10. As a preventative measure, set the http proxy and https proxy environment variables on both the indico-uwsgi and indico-celery services to force outgoing requests through a limiting proxy.

Exploit

Fix

SSRF

Time Of Check To Time Of Use

Weakness Enumeration

CWE-918

CWE-367

Related Identifiers

CVE-2026-25738

GHSA-F47C-3C5W-V7P4

Affected Products

Indico

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25738.json · Exploit
• https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4 · Vendor Advisory
• https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137 · Patch
• https://osv.dev/vulnerability/GHSA-f47c-3c5w-v7p4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25738 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25738 · Vendor Advisory
• https://github.com/indico/indico · Note
• https://github.com/indico/indico/releases/tag/v3.3.10 · Note
• https://twitter.com/CVEnew/status/2025892055143026727 · Twitter Post
• https://t.me/CVEtracker/45141 · Telegram Post
• https://t.me/cveNotify/153289 · Telegram Post