PT-2026-34572 · Squidex · Squidex

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-41177

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Squidex versions prior to 7.23.0

Description The Restore API is susceptible to Blind Server-Side Request Forgery (SSRF), a flaw where a server is tricked into making requests to an unintended location. The application does not validate the URI scheme of the Url parameter, enabling the use of the file:// protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, potentially leading to Local File Interaction (LFI) and the disclosure of sensitive system information via side-channel analysis of internal logs.

Recommendations Update to version 7.23.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-73

Related Identifiers

CVE-2026-41177

Affected Products

Squidex

References · 4

• 🔥 https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41177 · Security Note
• https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 · Note
• https://twitter.com/CVEnew/status/2047359932580626486 · Twitter Post