CVE-2026-107273 — Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /a…
Published: 2026-10-07 · CVSS: 5.3 · CVSS 4.0
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7