PT-2026-35272 · Bidingcc · Buildingai

Mida · Published 2026-04-26 · Updated 2026-04-30 · CVE-2026-7065

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BidingCC BuildingAI versions prior to 26.0.2

Description The Remote Upload API contains a server-side request forgery (SSRF) issue. This occurs when the uploadRemoteFile() function in the packages/core/src/modules/upload/services/file-storage.service.ts file fails to properly handle the url argument, allowing a remote attacker to initiate unauthorized requests from the server.

Recommendations Update to a version later than 26.0.1. As a temporary workaround, restrict access to the uploadRemoteFile() function until a patch is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7065

Affected Products

Buildingai

References · 10

• 🔥 https://github.com/BidingCC/BuildingAI/issues/110 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7065 · Security Note
• https://vuldb.com/vuln/359640/cti · Note
• https://twitter.com/VulmonFeeds/status/2048573894148125117 · Twitter Post
• https://vuldb.com/submit/798621 · Note
• https://vuldb.com/vuln/359640 · Note
• https://twitter.com/DFIR_Lab/status/2049654277585416646 · Twitter Post
• https://github.com/BidingCC/BuildingAI · Note
• https://twitter.com/CVEarity/status/2048702118870254077 · Twitter Post
• https://twitter.com/CVEnew/status/2048546593331384608 · Twitter Post