CVE-2026-24736 Details
Description
Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a "Blind" SSRF into a "Full Read" SSRF. As of time of publication, no patched versions are available.
A server-side request forgery (SSRF) vulnerability has been identified in Squidex versions through 7.21.0. The issue arises in the webhook configuration within the Rules engine, where the url parameter lacks proper validation or restrictions on destination IP addresses. This oversight allows the inclusion of local addresses such as 127.0.0.1 or localhost. When a rule is triggered, the backend server executes an HTTP request to the user-supplied URL. The server then logs the full HTTP response in the rule execution log, accessible via the API. This transforms a 'Blind' SSRF into a 'Full Read' SSRF, enabling authenticated attackers to access sensitive internal information.
Squidex should implement input validation for the url parameter in webhook actions, denying private IP ranges and localhost. Additionally, the HTTP client used for webhooks should be configured to disable redirects or strictly validate redirect targets.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2w | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| squidex.io squidex | <= 7.21.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 12, 2026 | Initial Analysis | [email protected] |
| Jan 27, 2026 | New CVE Received | [email protected] |