CVE-2026-2558 Details
Description
A flaw has been found in GeekAI up to 4.2.4. The affected element is the function Download of the file api/handler/net_handler.go. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in GeekAI versions through 4.2.4. The issue arises in the Download function within the file api/handler/net_handler.go. This vulnerability allows remote exploitation, as the function accepts user-provided URL parameters without any security validation. The interface does not require authentication, directly using http.Get() to fetch HTTP responses and return them to the user.
It is recommended to implement authentication and authorization for the '/api/download' endpoint to prevent unauthorized access. Additionally, URL validation should be introduced, including whitelisting allowed domains and blocking internal IP addresses and cloud metadata.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 16, 2026CISA-ADP
Assessed Feb 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yangjian102621/geekai/issues/256 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/yangjian102621/geekai/issues/256#issue-3888814886 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.346166 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.346166 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.750730 | [email protected] | ExploitIssue TrackingTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GeekAI | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 16, 2026 | New CVE Received | [email protected] |