CVE-2026-112254 Details
Description
A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A server-side request forgery (SSRF) vulnerability has been identified in the agit8or1 clientst0r application, specifically in versions prior to 3.17.587. The issue resides in the Property URL Importer component, within the _fetch_html function of locations/services/property_url_importer.py. The vulnerability allows logged-in users to manipulate the url parameter, causing the server to make requests to internal addresses, including loopback and private network IPs, as well as the cloud metadata address. This flaw has been present since version 2.11.4 and was never fixed until the release of version 3.17.587, which introduced a safeguard to prevent such internal address access.
Upgrade to agit8or1 clientst0r version 3.17.587 or later, which addresses the vulnerability by implementing a guard that prevents user-supplied URLs from reaching internal addresses. The updated version is available on the project's GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/agit8or1/clientst0r/ | [email protected] | Vendor |
| https://github.com/agit8or1/clientst0r/commit/7e75c6cc6a07621c10be9b07fafd99e89a02e327 | [email protected] | Source CodeVendor |
| https://github.com/agit8or1/clientst0r/releases/tag/v3.17.587 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-112254 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/986798 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422335 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/422335/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| agit8or1 clientst0r | <= 3.17.586 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |