CVE-2026-15143

Published: Jul 10, 2026Modified: Jul 10, 2026

9.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or access to internal network services.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://access.redhat.com/security/cve/CVE-2026-15143

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2498165

Source: secalert@redhat.com

Timeline

No history available yet.