CVE-2026-16223 Details
Description
A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
A server-side request forgery (SSRF) vulnerability exists in 1Panel CordysCRM versions through 1.4.1. The issue is located in the IntegrationConfigService.java file, specifically within the getSqlBotSrc function. The vulnerability arises because the application improperly validates the appSecret parameter, allowing remote attackers to manipulate it and cause the server to make unauthorized requests to external or internal resources.
Users are advised to implement whitelist validation for URLs, block internal IP ranges, restrict protocols to only allow HTTP and HTTPS, and sanitize all extracted URLs before making requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 19, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Panel-dev/CordysCRM/ | [email protected] | ProductVendor |
| https://github.com/1Panel-dev/CordysCRM/issues/2687 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/1Panel-dev/CordysCRM/issues/2688 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-16223 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/858045 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/submit/858046 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/380045 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/380045/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1Panel-dev CordysCRM | <= 1.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 19, 2026 | New CVE Received | [email protected] |