CVE-2026-49328 — Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF
Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network…
Published: 2026-06-01 · CVSS: 5.3 · CVSS 3.1
Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7