CVE-2026-49345 Details
Description
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in Mercator versions prior to 2026.05.09. The issue resides in the CVE configuration panel, specifically within the 'testProvider()' method of the 'ConfigurationController'. This method improperly sanitizes user input before passing it to 'curl_init()', allowing authenticated users with the 'configure' permission to make arbitrary outbound network requests. The vulnerability can be exploited by injecting a fragment character into the URL, bypassing default suffixes and gaining full control over the request destination. Additionally, the absence of validation for URL schemes and hostnames, along with the lack of restrictions on private or loopback IP addresses, further exacerbates the issue. Exploitation of this vulnerability could lead to internal network scanning or, under certain conditions, remote code execution via unauthenticated Redis or Memcached services.
Users can upgrade to Mercator version 2026.05.19 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mercator | < 2026.05.09 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |