CVE-2026-125366: Omnom through 0.9.0 SSRF via Add Feed /add_feed Route
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /addfeed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. No user interaction is required, and the vulnerable request is made by the Omnom server.
What access can an attacker target through the vulnerable route?
An attacker can submit feed URLs pointing to arbitrary hosts, including internal addresses. Reflected error messages can be used to probe reachable internal hosts and ports.
Which functionality is involved?
The issue is triggered through the /add_feed route when feed URLs are processed. The described request paths include getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL.