CVE-2026-112237 Details
Description
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
A server-side request forgery (SSRF) vulnerability has been identified in the TYPO3 extension 'Kitodo.Presentation' (dlf), affecting versions 6.0.0 and below, as well as 7.0.0 to 7.0.1. The vulnerability arises because the extension provides a public proxy endpoint that fetches URLs on behalf of visitors. For one HTTP request method, the endpoint fails to apply the necessary authorization check, allowing unauthenticated attackers to control the URLs being fetched. This flaw enables attackers to make the server send requests to arbitrary internal or external hosts. While response bodies are not disclosed, attackers can receive status codes and selected response headers, facilitating the probing of internal hosts and ports.
Users of the 'Kitodo.Presentation' extension are advised to update to version 6.0.1 or 7.0.2, available through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extensions repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-032 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| Kitodo.Presentation | <= 6.0.0 (semver) >= 7.0.0, <= 7.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |