CVE-2026-41195 — mosparo: Rule package source URL stored SSRF enables internal HTTP probing
mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor rol…
Published: 2026-05-12 · CVSS: 5.0 · CVSS 3.1
mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and does not restrict private or loopback destinations, this becomes a stored SSRF primitive that can be turned into an internal HTTP probing oracle. This vulnerability is fixed in 1.4.13.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7