CVE-2026-7158 Details
Description
A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validate_url_safe of the file src/mcp_url_downloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in dmitryglhf mcp-url-downloader versions prior to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. The vulnerability arises in the _validate_url_safe function within src/mcp_url_downloader/server.py. The application's initial URL validation only blocks certain addresses, such as localhost and private IP ranges. However, it fails to re-validate URLs after redirects are followed, allowing attackers to exploit this oversight. By chaining redirects through a controlled public URL, the downloader can be made to access internal resources, such as cloud metadata services or local applications, and save the retrieved data to disk.
As of now, there is no official patch available for this vulnerability. However, it is recommended to manually validate redirect targets and block access to internal resources until a fix is implemented.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dmitryglhf/url-download-mcp/issues/2 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/submit/802062 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359757 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/359757/cti | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dmitryglhf mcp-url-downloader | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |