CVE-2026-111720 — fish-island-backend through commit 7c61b78 SSRF via /api/web/parse
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-s…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7