CVE-2026-110223: Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Kavita and able to submit a URL to the POST /api/Cbl/upload-cbl-file endpoint. The issue affects Kavita versions 0.9.0 through 0.9.1.4.
What does an attacker need to bypass the blocklist?
The supplied URL must use either a hostname that resolves to an internal address after initial validation through DNS rebinding, or an HTTPS URL that redirects to an internal address. This can enable blind probing of internal ports and services from the Kavita server.
How can defenders identify relevant exposure?
Review requests to POST /api/Cbl/upload-cbl-file from authenticated users, particularly URLs using attacker-controlled hostnames or redirecting HTTPS endpoints. Systems running any affected version should be considered exposed when authenticated users can access this endpoint.