CVE-2026-41172 Details
Description
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.
A server-side request forgery (SSRF) vulnerability has been identified in Squidex, an open-source headless content management system, prior to version 7.23.0. This vulnerability allows users with asset upload permissions to manipulate the server into fetching arbitrary URLs, including those targeting localhost or private networks, and to save the retrieved data as an asset. The issue arises because the URL upload process does not properly validate or restrict the URLs being accessed, leaving internal resources exposed.
Users can update to Squidex version 7.23.0 or later, where this vulnerability has been fixed. Additionally, for deployments that require asset uploads via URL, it's recommended to review and implement proper SSRF protections.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 22, 2026CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Squidex/squidex/security/advisories/GHSA-x7cq-4f4c-8qcv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 | [email protected] | Source CodeVendor |
| https://github.com/Squidex/squidex/security/advisories/GHSA-x7cq-4f4c-8qcv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Squidex | <= 7.21.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |