PT-2026-34570 · Squidex · Squidex

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-41172

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Squidex versions prior to 7.23.0

Description An SSRF (Server-Side Request Forgery), which occurs when a server is tricked into making requests to an unintended location, allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost or private network targets, and persist the response as an asset.

Recommendations Update to version 7.23.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41172

Affected Products

Squidex

References · 4

• 🔥 https://github.com/Squidex/squidex/security/advisories/GHSA-x7cq-4f4c-8qcv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41172 · Security Note
• https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 · Note
• https://twitter.com/CVEnew/status/2047359933687935307 · Twitter Post