CVE-2026-91081: Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Anonymous attackers can exploit the cors-proxy endpoint if they can provide a public document UUID. No authentication or user interaction is required.
What access can an attacker gain through the vulnerable endpoint?
An attacker can cause the server to make outbound requests and, using DNS time-of-check-time-of-use races and shared address space bypasses, access internal network resources. The reported impact includes exfiltration of image content.
Which deployments are known to be affected?
Docs through version 5.6.1 is affected. The available information does not state whether the cors-proxy endpoint is enabled or reachable in a default deployment.