PT-2026-34665 · Unknown · Socialengine

Egidio Romano · Published 2026-04-23 · Updated 2026-04-27 · CVE-2026-41461

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions SocialEngine versions prior to 7.8.1

Description A blind server-side request forgery exists in the "/core/link/preview" endpoint. The issue occurs because user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can provide arbitrary URLs, including internal network and loopback addresses, forcing the server to issue HTTP requests to attacker-controlled destinations. This allows for internal network enumeration and access to services not intended to be externally reachable.

Recommendations Update to a version later than 7.8.0. As a temporary workaround, restrict access to the "/core/link/preview" endpoint or avoid using the uri parameter until a patch is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41461

Affected Products

Socialengine

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41461 · Security Note
• https://t.me/cveNotify/161109 · Telegram Post
• http://seclists.org/fulldisclosure/2026/Apr/11 · Note
• https://vulncheck.com/advisories/socialengine-blind-ssrf-via-core-link-preview · Note
• https://socialengine.com · Note
• https://karmainsecurity.com/KIS-2026-07 · Note