CVE-2026-122008: Oqtane Framework before 10.3.0 SSRF via File Upload From URL
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated registered user can exploit it. The attacker does not need elevated privileges or user interaction.
What access does an attacker need to reach internal services?
The attacker needs access to the UploadFile endpoint and control of its url parameter. They can cause the server to fetch arbitrary URLs, including localhost-bound interfaces and cloud instance metadata services.
Which deployments need to be remediated?
Oqtane Framework deployments running a version before 10.3.0 are affected. Updating to 10.3.0 addresses the affected version range.
What can an attacker obtain through successful exploitation?
Fetched responses can be saved into the attacker's own user folder and then retrieved through the download endpoint. This can expose sensitive data from internal resources and support internal host and port enumeration.