CVE-2026-54166 Details
Description
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted `fetch()` request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.
A server-side request forgery (SSRF) vulnerability has been identified in Shelf versions prior to 1.20.3. This issue allows authenticated users with the 'asset:import' permission to bypass the 'imageUrl' validation in the Asset CSV Content Import feature. Exploitation of this vulnerability enables attackers to send HTTP requests to URLs they control, which can be used to access internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. The vulnerability arises because the validation logic does not adequately restrict destination hosts or IP ranges, and the application performs unrestricted fetch requests to the supplied URLs. Additionally, the response bodies are fully buffered before size validation, creating a potential memory exhaustion risk.
Users are advised to update to Shelf version 1.20.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-xgrm-8w6v-mvjg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shelf | < 1.20.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |