PT-2026-22774 · Homebox · Homebox

G3Xar · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-27600

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.24.0-rc.1

Description HomeBox is a home inventory and organization system. The notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. There is no validation applied to the supplied host, IP address, or port. The application’s user interface behavior differs based on the network state of the destination, creating a behavioral side-channel that enables internal service enumeration. The application does not return the response body from the target service.

Recommendations Update to version 0.24.0-rc.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27600

GHSA-CM7P-5MG5-82PM

Affected Products

Homebox

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27600.json · Exploit
• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27600 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27600 · Vendor Advisory
• https://t.me/CVEtracker/46255 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028975329147027509 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029072696911257678 · Twitter Post
• https://reddit.com/r/selfhosted/comments/1rjtl6r/homebox_v0420_released · Reddit Post
• https://twitter.com/CVEnew/status/2028974436628492767 · Twitter Post