CVE-2026-7065 Details
Description
A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the file packages/core/src/modules/upload/services/file-storage.service.ts of the component Remote Upload API. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in BidingCC BuildingAI versions through 26.0.1. The issue arises in the remote upload API, specifically within the 'uploadRemoteFile' function of the 'file-storage.service.ts' module. The vulnerability allows unauthenticated attackers to manipulate the 'url' parameter, enabling them to coerce the server into making unauthorized HTTP requests. This could be exploited to access internal services or cloud metadata endpoints.
It is recommended to disable the public remote upload endpoint if not needed, and to implement a strict allowlist for URLs that can be fetched. Additionally, block access to loopback and private IP addresses after DNS resolution, and consider adding authentication and rate limiting to the remote upload endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BidingCC/BuildingAI/ | [email protected] | ProductVendor |
| https://github.com/BidingCC/BuildingAI/issues/110 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/798621 | [email protected] | Issue TrackingTechnical Description |
| https://vuldb.com/vuln/359640 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/359640/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BidingCC BuildingAI | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |