CVE-2026-65967: Fider: Server-Side Request Forgery (SSRF) via Webhook URL
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fiderto a version that resolves this vulnerability.Fixed in 0.34.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrative privileges in Fider to configure a webhook URL. The vulnerable webhook handling then lets that user cause the Fider server to make arbitrary HTTP requests.
Are default deployments affected?
The available information identifies webhook URL validation as the affected behavior, but does not state whether webhooks are enabled or usable by default. Exposure depends on whether an administrative user can configure webhooks.
What resources could an attacker reach through the vulnerable server?
The server can be induced to request internal or external network resources. This may include internal services and cloud metadata endpoints that are reachable from the Fider host.
How can I determine whether my deployment is affected?
Deployments running a version earlier than 0.34.0 are affected. Version 0.34.0 contains the patch.
What should be done if an immediate upgrade is not possible?
Limit administrative access to trusted users and restrict the Fider server's outbound network access, particularly access to internal services and cloud metadata endpoints. These measures reduce the locations that a malicious webhook URL could reach.