PT-2026-45399 · Apache · Fesod-Sheet

Xu Han · Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-49328

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Fesod (Incubating) fesod-sheet versions prior to 2.0.2-incubating

Description Server-Side Request Forgery (SSRF) in the UrlImageConverter component allows attackers to trigger outbound network requests to internal or restricted resources by providing a malicious image URL. SSRF is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Upgrade to version 2.0.2-incubating.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-49328

Affected Products

Fesod-Sheet

References · 11

• https://github.com/apache/fesod/pull/917 · Patch
• https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49328 · Security Note
• https://github.com/apache/fesod/releases/tag/2.0.2-incubating · Note
• https://twitter.com/the_yellow_fall/status/2061658057961353373 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2061429354454831317 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/01/4 · Note
• https://fesod.apache.org/docs/download · Note
• https://t.me/cveNotify/165474 · Telegram Post
• https://t.me/CVEtracker/55480 · Telegram Post
• https://twitter.com/oss_security/status/2061637650491003364 · Twitter Post