CVE-2026-91750 — WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs…
Published: 2026-09-15 · CVSS: 7.1 · CVSS 4.0
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7