CVE-2026-55190 Details
Description
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and file_get_contents($ogImage)). At time of publication, there are no publicly available patches.
A server-side request forgery (SSRF) vulnerability has been identified in Event Schedule versions through 1.0.0. The issue arises in the method 'App\Utils\UrlUtils::isUrlSafe()', which is intended to validate user-supplied import URLs. This validation can be bypassed, allowing attackers to reach internal or localhost services. The vulnerability is exploited when the 'ImportCuratorEvents' function fetches the URL using 'Http::get($url)', parses the response, and imports it as event data. Additionally, 'file_get_contents($ogImage)' can be used to access internal services. At the time of publication, no patches are available.
It is recommended to strip surrounding brackets from IPv6 hosts before validation, resolve dual-stack hosts while rejecting failed resolutions, and pin validated IPs for actual requests to prevent re-resolution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eventschedule/eventschedule/security/advisories/GHSA-664j-55hw-p8fm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Event Schedule | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |