CVE-2026-112991: MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
The htmltomarkdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its issafeurl() URL validation function. The BLOCKEDRANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).
An authenticated user with the ability to create or modify MISP attributes that trigger the htmltomarkdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.
The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Extend the BLOCKED_RANGES list used by is_safe_url() to block 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10; retain IPv4-mapped IPv6 normalization so mapped forms are also blocked.
MISP Modules html_to_markdown BLOCKED_RANGES in is_safe_url() = 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, fe80::/10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can create or modify MISP attributes that trigger the html_to_markdown expansion module can supply a URL for server-side retrieval.
Which destinations can bypass the URL validation?
The incomplete block list permits 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. These include addresses that can reach loopback, carrier-grade NAT, IPv6 unique-local, and IPv6 link-local services.
What can an attacker access through the vulnerable request?
Requests are issued from the MISP server's network context. An attacker may probe and read responses from otherwise unreachable internal services, carrier-grade NAT infrastructure, or link-local endpoints.