CVE-2026-86119: Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Webstudio deployments through 0.296.0 are exposed when the RESIZE_ORIGIN environment variable is unset and the /cgi/image, /cgi/video, or /cgi/asset proxy routes are reachable by an attacker.
Does exploitation require an account or user interaction?
No. The vulnerability is unauthenticated and can be exploited remotely by supplying arbitrary URLs to the affected proxy endpoints.
What could an attacker reach through the vulnerable routes?
An attacker may use the server to request cloud instance metadata, access internal services, and conduct network reconnaissance against the instance infrastructure.
What configuration change can reduce exposure if patching is not immediately possible?
Set the RESIZE_ORIGIN environment variable. The reported vulnerable condition occurs when this variable is unset.