CVE-2026-76795: AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery
A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AeternaLabsHQ PullMDto a version that resolves this vulnerability.Fixed in 3.3.0Patch 96448894cc93ccecb0bdcbf263a9d25390a8455e
Event History
Frequently Asked Questions
Who can exploit this issue?
The REST API endpoint is reachable remotely, and exploitation requires no privileges or user interaction. Public exploit disclosure means attempts may occur where affected instances are exposed to untrusted network users.
Which deployments are affected and what version fixes it?
PullMD version 3.2.0 is identified as affected. Upgrade to version 3.3.0; the associated patch identifier is 96448894cc93ccecb0bdcbf263a9d25390a8455e.
What is the impact of successful exploitation?
An attacker can manipulate the API's url argument to cause server-side requests. The provided severity vector rates confidentiality, integrity, and availability impact as low.