CVE-2026-49328

Published: Jun 1, 2026Modified: Jul 22, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

Affected (1)

Products: Apache: Fesod

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Fesod	Before 2.0.2

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://fesod.apache.org/docs/download

Source: security@apache.org

Product

https://github.com/apache/fesod/pull/917

Source: security@apache.org

Issue TrackingPatch

https://github.com/apache/fesod/releases/tag/2.0.2-incubating

Source: security@apache.org

Release Notes

https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/06/01/4

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.