CVE-2026-112254: agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery
A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
agit8or1 clientst0rto a version that resolves this vulnerability.Fixed in 3.17.587Patch 7e75c6cc6a07621c10be9b07fafd99e89a02e327
Event History
Frequently Asked Questions
Which deployments need to be remediated?
Deployments of agit8or1 clientst0r through version 3.17.586 are affected where the Property URL Importer component is present. Version 3.17.587 fixes the issue.
What access does an attacker need to exploit this issue?
The attack can be launched remotely, but the severity vector indicates low privileges are required. No user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can cause the affected importer to make server-side requests to attacker-controlled URLs. The provided severity vector indicates low confidentiality impact, with no integrity or availability impact.
What should be done if the issue is confirmed?
Upgrade the affected component to version 3.17.587. The fix is identified by patch commit 7e75c6cc6a07621c10be9b07fafd99e89a02e327.