CVE-2026-18359: Server-Side Request Forgery (SSRF) in eScriptorium
Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter of POST /api/documents/{pk}/imports/, because the IMPORTALLOWEDDOMAINS setting defaults to '' and no address filtering, redirect cap or timeout is applied
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.04.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.13.9 - Configuration
Update Scripta eScriptorium configuration so IMPORT_ALLOWED_DOMAINS contains an explicit allowlist of permitted domains rather than the default '*' to mitigate SSRF via mets_uri or iiif_uri in POST /api/documents/{pk}/imports/.
Scripta eScriptorium IMPORT_ALLOWED_DOMAINS = explicit list of permitted domains (instead of default '*')
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18359?
The severity of CVE-2026-18359 is rated as high with a score of 8.5.
What type of vulnerability is CVE-2026-18359?
CVE-2026-18359 is a Server-Side Request Forgery (SSRF) vulnerability affecting eScriptorium.
How do I fix CVE-2026-18359?
To fix CVE-2026-18359, update eScriptorium to version 26.04.2 or later where the vulnerability has been addressed.
Who can exploit CVE-2026-18359?
CVE-2026-18359 can be exploited by remote authenticated users of eScriptorium.
What are the potential impacts of CVE-2026-18359?
The potential impacts of CVE-2026-18359 include the possibility for attackers to issue arbitrary HTTP requests to internal hosts.