PT-2026-40450 · Mosparo · Mosparo

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-41195

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions mosparo versions prior to 1.4.13

Description The automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server subsequently fetches. Since the server follows http/https redirects and does not restrict private or loopback destinations, this creates a stored Server-Side Request Forgery (SSRF)—a flaw where the server is tricked into making requests to an unintended location—which can be used as an internal HTTP probing oracle to discover internal network services.

Recommendations Update to version 1.4.13.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41195

Affected Products

Mosparo

References · 3

• 🔥 https://github.com/mosparo/mosparo/security/advisories/GHSA-92fh-26qf-r8rg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41195 · Security Note
• https://twitter.com/CVEnew/status/2054323982762189271 · Twitter Post