PT-2026-22060 · Unknown · Terriajs-Server

Peter Hassall · Published 2026-02-26 · Updated 2026-03-04 · CVE-2026-27818

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TerriaJS-Server versions prior to 4.0.3

Description A validation flaw permits an attacker to proxy domains not explicitly listed in the proxyableDomains configuration. The validation process only verifies if a hostname ends with an allowed domain, which allows malicious domains to be proxied through the server. For example, if example.com is in proxyableDomains, maliciousexample.com could also be proxied. This bypasses proxy restrictions.

Recommendations Upgrade to version 4.0.3 to resolve the issue.

Exploit

Fix

RCE

SSRF

Weakness Enumeration

CWE-20

CWE-918

Related Identifiers

CVE-2026-27818

GHSA-W789-49FC-V8HR

Affected Products

Terriajs-Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27818.json · Exploit
• https://github.com/TerriaJS/terriajs-server/security/advisories/GHSA-w789-49fc-v8hr · Vendor Advisory
• https://github.com/TerriaJS/terriajs-server/commit/3aaa5d9717162b245ae4569232bbe7d8673c913f · Patch
• https://osv.dev/vulnerability/CVE-2026-27818 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w789-49fc-v8hr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27818 · Security Note
• https://github.com/TerriaJS/terriajs-server · Note
• https://github.com/TerriaJS/terriajs-server/releases/tag/4.0.3 · Note
• https://reddit.com/r/VulnMatter/comments/1rfmr3t/resumen_diario_de_vulnerabilidades_26022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1rfmr6l/resumen_diario_de_vulnerabilidades_26022026 · Reddit Post
• https://twitter.com/CVEnew/status/2027004249595367504 · Twitter Post
• https://twitter.com/_cvereports/status/2027068723262038052 · Twitter Post
• https://t.me/cveNotify/154210 · Telegram Post
• https://t.me/CVEtracker/45800 · Telegram Post