CVE-2026-111662 — Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7