CVE-2026-111663 Details
Description
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
A server-side request forgery (SSRF) vulnerability has been identified in Chaskiq versions through 2.0.3. This vulnerability allows unauthenticated attackers to fetch arbitrary URLs by exploiting the createUrlUpload GraphQL mutation. The issue arises because the mutation does not validate or authorize the URLs provided by the user. Attackers can send internal URLs, including cloud instance metadata endpoints, through the mutation and retrieve the full response via the ActiveStorage blob URL returned by the mutation.
Chaskiq users should update to a version that addresses this vulnerability. The official Chaskiq repository should be checked for the latest releases and any relevant security advisories.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb#L3-L33 | [email protected] | Source CodeVendor |
| https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb#L29-L66 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chaskiq | <= 2.0.3 (semver) 2f487acfc9924c74db411ad2d0638140c1d379a1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |