PT-2026-25829 · Taoofagi · Easegen-Admin

Vuldb + 1 · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-4284

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions taoofagi easegen-admin versions prior to 8f87936ac774065b92fb20aab55b274a6ea76433

Description A server-side request forgery (SSRF) issue exists in the downloadFile function within the PPT File Handler component. The issue is caused by manipulation of the url argument. This allows for remote exploitation. The product utilizes a rolling release model, and no specific version details for affected or updated releases are available. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 8f87936ac774065b92fb20aab55b274a6ea76433 should be updated. As a temporary workaround, consider restricting access to the downloadFile function until a suitable update is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4284

Affected Products

Easegen-Admin

References · 8

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/XF5WdvWAEoU9jyx2C2mcImSMnBg?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4284 · Security Note
• https://t.me/cveNotify/155571 · Telegram Post
• https://vuldb.com/?submit.771949 · Note
• https://twitter.com/CVEnew/status/2033755313485058054 · Twitter Post
• https://vuldb.com/?ctiid.351290 · Note
• https://twitter.com/cyberbivash/status/2033724859126030686 · Twitter Post
• https://vuldb.com/?id.351290 · Note