CVE-2026-111720: fish-island-backend through commit 7c61b78 SSRF via /api/web/parse
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the application's GET /api/web/parse endpoint can exploit it. Authentication and user interaction are not required.
What can an attacker access through the vulnerable endpoint?
An attacker can supply a URL and cause the server to request internal hosts, loopback services, or cloud metadata endpoints. The response exposes fetched page titles, meta descriptions, and favicons.
Are redirects relevant to exploitation?
Yes. The server uses redirect-following OkHttp requests, allowing attacker-supplied URLs to redirect to internal or otherwise restricted destinations.
How can I determine whether my deployment is affected?
Deployments of fish-island-backend through commit 7c61b78 are affected if GET /api/web/parse is reachable and accepts the url parameter. Test only in an authorized environment by determining whether the endpoint causes the server to fetch a supplied URL.