PT-2026-35752 · O2Oa · O2Oa

Larlarua · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7291

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions o2oa versions prior to 10.0

Description A flaw in the URL Fetching component allows for remote server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This issue exists within the FileAction() function of the FileAction.java file and is triggered by manipulating the fileUrl argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the FileAction() function or the URL Fetching component to minimize the risk of exploitation.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7291

Affected Products

O2Oa

References · 8

• 🔥 https://github.com/o2oa/o2oa/issues/195 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7291 · Security Note
• https://twitter.com/VulmonFeeds/status/2049252824354103596 · Twitter Post
• https://vuldb.com/vuln/359951/cti · Note
• https://vuldb.com/vuln/359951 · Note
• https://twitter.com/CVEnew/status/2049227559494209783 · Twitter Post
• https://github.com/o2oa/o2oa · Note
• https://vuldb.com/submit/803073 · Note