CVE-2026-51031 Details
Description
FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information
A server-side request forgery (SSRF) vulnerability has been identified in FlareSolverr versions prior to 3.4.7. The vulnerability exists in the '/v1' API endpoint, where user-supplied 'url' parameters are processed without proper validation. This flaw allows remote attackers to access sensitive information by crafting malicious URLs that target internal resources or local files. Additionally, the vulnerability enables arbitrary local file reads, as Chrome is launched with the '--no-sandbox' flag, granting access to the 'file://' protocol.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://xinyi234.github.io/2026/04/13/FlareSolverr-Server-Side-Request-Forgery-SSRF-Vulnerability-Report/ | CISA-ADP | AdvisoryExploitTechnical Analysis |
| https://xinyi234.github.io/2026/04/13/FlareSolverr-Server-Side-Request-Forgery-SSRF-Vulnerability-Report/ | [email protected] | AdvisoryExploitTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| FlareSolverr | <= 3.4.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |