CVE-2026-111720 Details

A server-side request forgery (SSRF) vulnerability has been identified in the Fish Island backend application, specifically in the default branch through commit 7c61b78. This vulnerability allows unauthenticated remote attackers to manipulate the server into fetching external URLs provided via the 'url' parameter of the 'GET /api/web/parse' endpoint. The vulnerability can be exploited to access internal hosts, loopback services, or cloud metadata endpoints. The server's response is parsed to extract and return the page title, meta description, and favicon, potentially disclosing sensitive information about internal resources.

To address this vulnerability, the application should require authentication for the '/api/web/parse' endpoint and implement validation to ensure that only HTTP and HTTPS URLs are accepted. Additionally, the application should reject loopback addresses, private IP ranges, and link-local addresses before processing the request. After each redirect, the application should re-validate the URL to prevent bypassing these checks.