CVE-2026-101300: Server-Side Request Forgery in Wegow PDF export
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Wegow user with a promoter account. The attacker must be able to modify the svg parameter in the POST request sent when using the Download PDF function.
What systems receive the attacker-controlled requests?
The manipulated SVG content is processed by export.highcharts.com. That export service sends HTTP requests to attacker-controlled external resources and embeds the returned content in the generated PDF.
Is there a workaround if patching is unavailable?
The provided report does not identify a vendor patch or configuration workaround. Restricting access to promoter accounts and limiting use of the PDF export feature would reduce exposure, but no specific mitigation is stated.