CVE-2026-19770: feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery
A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19770?
The severity of CVE-2026-19770 is medium with a score of 5.3.
What type of vulnerability is CVE-2026-19770?
CVE-2026-19770 is a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-19770?
To mitigate CVE-2026-19770, validate and sanitize the 'downloadUrl' argument before processing it within the downloadReport function.
Which component is affected by CVE-2026-19770?
CVE-2026-19770 affects the Download Endpoint of the feedmob fm-mcp-servers version 0.0.3.
What argument manipulation is involved in CVE-2026-19770?
CVE-2026-19770 involves the manipulation of the 'downloadUrl' argument leading to potential server-side request forgery.