CVE-2026-47170: Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint
Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Garlic-Hubto a version that resolves this vulnerability.Fixed in 1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47170?
The severity of CVE-2026-47170 is high with a CVSS score of 7.7.
How do I fix CVE-2026-47170?
To fix CVE-2026-47170, upgrade Garlic-Hub to version 1.1 or later.
What type of vulnerability is CVE-2026-47170?
CVE-2026-47170 is a Server-Side Request Forgery (SSRF) vulnerability.
What can attackers do with CVE-2026-47170?
Attackers can exploit CVE-2026-47170 to issue arbitrary HTTP requests to internal services, enabling internal port scanning.
Who is affected by CVE-2026-47170?
Authenticated users of Garlic-Hub versions prior to 1.1 are affected by CVE-2026-47170.