PT-2026-40251 · Xibo Cms · Xibo Cms

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-42141

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xibo versions prior to 4.4.1

Description An authenticated Server-Side Request Forgery (SSRF) in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be used to scan internal infrastructure, access local cloud metadata endpoints such as AWS IMDS (Instance Metadata Service, which provides data about a running instance), interact with unauthenticated internal services, or exfiltrate data.

Recommendations Update to version 4.4.1.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42141

Affected Products

Xibo Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-42141 · Security Note
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh · Note
• https://twitter.com/CVEnew/status/2054340996062720180 · Twitter Post