CVE-2026-112237: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote requester who can reach the public proxy endpoint can exploit it. No account or prior authorization is required for the affected HTTP request method.
What can an attacker access through the vulnerable endpoint?
The attacker can cause the server to send requests to arbitrary internal or external hosts and can use returned status codes and selected response headers to probe reachable hosts and ports. Response bodies are not disclosed.
How can I determine whether my deployment is exposed?
A deployment is exposed if it uses the Kitodo.Presentation extension and its public proxy endpoint is reachable by unauthenticated users. The issue specifically affects the HTTP request method for which the endpoint skips its authorization check.