PT-2026-48709 · Garlic Signage · Garlic-Hub

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-47170

Mitre

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-47170

Affected Products

Garlic-Hub

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-47170 · Security Note
• https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r · Note
• https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5 · Note