CVE-2026-41177 Details
Description
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied `Url` parameter, allowing the use of the `file://` protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.
A blind server-side request forgery (SSRF) vulnerability has been identified in the Squidex Restore API, prior to version 7.23.0. The issue arises because the API does not properly validate the URI scheme of the user-supplied 'Url' parameter, allowing the 'file://' protocol to be used. This vulnerability enables authenticated administrators to manipulate the backend server into accessing the local filesystem, potentially leading to local file interaction (LFI) and the unauthorized disclosure of sensitive system information through side-channel analysis of internal logs.
Users can update to Squidex version 7.23.0 or later, where this vulnerability has been fixed. Additionally, it is recommended to configure the application to disallow restores from local files by setting the 'BACKUPS__ALLOWRESTOREFROMLOCALFILES' option to 'false'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 22, 2026CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 | [email protected] | Source CodeVendor |
| https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Squidex | <= 7.21.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |