CVE-2026-55421: Open edX Platform: SSRF in Studio Video Download Endpoint
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allowredirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open edX Platform (Studio Video Download Endpoint)to a version that resolves this vulnerability.Patch 00b7c3c
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges. An attacker must be able to submit values for files[].url to the Studio video download endpoint.
What can an attacker access through the vulnerable endpoint?
The server fetches the supplied URL and includes the fetched bytes in a ZIP response, allowing response data to be exfiltrated. Because redirects are followed, a supplied URL can redirect the server to another destination.
Are deployments affected by default?
The provided information does not identify a configuration prerequisite. The affected behavior is the endpoint's use of a user-supplied URL with server-side requests.get and redirect following.
What should be done if the installation cannot be patched immediately?
The available data does not provide a documented workaround. Prioritize restricting access to the affected Studio endpoint to trusted high-privilege users until the patch can be applied.
How can I determine whether an instance is vulnerable?
Check whether the deployment includes commit 00b7c3c. Versions or code states before that commit use the vulnerable fetch path; the issue is patched by that commit.