PT-2026-5219 · Nocodb · Nocodb

Kolega-Ai-Dev

·

Published

2026-01-28

·

Updated

2026-05-05

·

CVE-2026-24767

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.0
Description A Server-Side Request Forgery (SSRF) issue exists in the uploadViaURL functionality due to an unprotected HEAD request. The initial metadata request executes without validation, allowing limited outbound requests to arbitrary URLs before SSRF controls are applied. The uploadViaURL() function uses axios.head() to retrieve metadata without SSRF filtering. This request is performed before SSRF protections are enforced. The impact is limited as only HEAD requests are affected, and no direct exfiltration of response data occurs. However, it may allow blind SSRF via outbound HEAD requests, limited internal service probing, and interaction with sensitive internal endpoints that respond to HEAD requests. The issue does not provide arbitrary data access or full internal network compromise on its own. A proof of concept involves sending a POST request to the /api/v2/storage/upload-by-url endpoint with a malicious URL in the url parameter.
Recommendations Versions prior to 0.301.0 should be updated to version 0.301.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-24767
GHSA-XR7V-J379-34V9

Affected Products

Nocodb