CVE-2026-112358: TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery
A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: "[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TiBillet Lespass APIto a version that resolves this vulnerability.Fixed in v2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be triggered remotely by manipulating the img_url or image_url argument handled by the APIv1 get_img_from_url function. The supplied scoring indicates high attack complexity and high privileges required.
Which deployments are affected?
TiBillet Lespass versions up to commit 10e87909c5d526dffa6d424c104fc12860740537 are affected. The vulnerable functionality is in APIv1 serializers, and the provided information does not establish whether every default deployment exposes the affected endpoints.
What mitigation is planned if an immediate patch is unavailable?
The vendor plans destination-IP validation, redirect re-checks, and timeout and size limits for remote image downloads in the replacement v2 API. The affected v1 endpoints and their serializers are planned for removal in the next major release.