PT-2026-58068 · Unknown · Easyappointments

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-52840

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0

Description An issue exists where the Caldav::connect to server function in application/controllers/Caldav.php processes the caldav url variable without validating the scheme or host. This allows an authenticated backend user, such as an admin, provider, or secretary, to perform a Server-Side Request Forgery (SSRF), enabling access to loopback, RFC1918, and link-local hosts within the deployment network. The SSRF is semi-blind because the Guzzle exception path returns the upstream status code and approximately 120 bytes of the response body within the JSON message field.

Recommendations Update to version 1.6.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-52840

GHSA-PM5P-7W5H-JM5Q

Affected Products

Easyappointments

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52840.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-52840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52840 · Security Note
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q · Note
• https://github.com/alextselegidis/easyappointments/commit/6eb9336a91cfb276379506625e81f5bd9ed3a536 · Note