CVE-2026-59095 Details
Description
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.
A server-side request forgery (SSRF) vulnerability has been identified in LobeChat versions prior to 2.2.10-canary.18. This vulnerability allows authenticated attackers to send internal HTTP requests to arbitrary URLs. The issue arises because user-controlled input is sent to the skill import service and topic cover update endpoints without proper validation, enabling access to internal addresses such as cloud instance metadata endpoints. Exploitation of this vulnerability could lead to the disclosure of internal service responses and cloud credentials.
The vulnerability has been fixed in LobeChat version 2.2.10-canary.18 by routing user-supplied URL fetches through the 'ssrfSafeFetch' helper, which enforces proper URL validation and blocks access to internal and link-local addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lobehub/lobehub/issues/16536 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/lobehub/lobehub/pull/16601 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/lobechat-canary-18-ssrf-via-importfromurl-and-fetchimagefromurl | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LobeHub | < 2.2.10-canary.18 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |