CVE-2026-15525 Details
Description
A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performing a manipulation of the argument final_url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.10.0 is able to resolve this issue. The patch is named 217399723e3a2fb39389e5355d49ed80aaf9ea7c. Upgrading the affected component is advised.
A server-side request forgery (SSRF) vulnerability has been identified in kLOsk adloop versions through 0.9.0. The issue arises in the URL validation function of the ads writing module, where user-supplied URLs are checked for reachability without proper validation of the URL scheme or host. This flaw allows for requests to internal, loopback, or metadata endpoints, as well as access to local files via the 'file://' scheme. The vulnerability can be exploited remotely, and the existence of local files can be probed by the attacker.
Users are advised to upgrade to kLOsk adloop version 0.10.0 or later, where this vulnerability has been fixed. The latest version can be installed via pip.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kLOsk/adloop/ | [email protected] | ProductSource CodeVendor |
| https://github.com/kLOsk/adloop/commit/217399723e3a2fb39389e5355d49ed80aaf9ea7c | [email protected] | Source CodeVendor |
| https://github.com/kLOsk/adloop/issues/41 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/kLOsk/adloop/releases/tag/v0.10.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-15525 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/854528 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/377854 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/377854/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kLOsk adloop | <= 0.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |