PT-2026-34570 · Squidex · Squidex

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-41172

Mitre

CVSS v4.0

8.6

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41172

Affected Products

Squidex

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41172 · Security Note
• https://github.com/Squidex/squidex/security/advisories/GHSA-x7cq-4f4c-8qcv · Note
• https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 · Note