CVE-2026-82044 — UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by suppl…
Published: 2026-10-02 · CVSS: 6.3 · CVSS 4.0
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7