CVE-2026-55190: Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and filegetcontents($ogImage)). At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs low-privileged access and the ability to provide an event import URL. No user interaction is required.
Which deployments should be considered affected?
Event Schedule versions 1.0.0 and earlier are affected where user-supplied URLs can reach the event-import functionality.
What systems could an attacker cause the application to contact?
The bypasses can cause requests to internal or localhost services. The fetched response can then be parsed and imported as event data, and an Open Graph image URL may also be fetched.
Is a public patch available?
No publicly available patches were available at the time of publication.