CVE-2026-94051 Details
Description
A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument pdf_file_path results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in the 0717376 cowork_bench project, specifically in the pdf-tools-mcp component, prior to the commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d. The vulnerability arises in the 'get_pdf_info' tool, where the 'pdf_file_path' argument is not properly validated before being used to make HTTP requests. This allows an attacker to manipulate the argument to redirect requests to internal services or loopback interfaces, potentially leading to unauthorized access or information disclosure.
It is recommended to implement proper validation of the 'pdf_file_path' argument to restrict requests to only allowed destinations and to disable automatic redirects or validate them before following.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 20, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0717376/cowork_bench/ | [email protected] | Source CodeVendor |
| https://github.com/0717376/cowork_bench/issues/1 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/Xh1Xxhg/public_exp/issues/7 | [email protected] | ExploitIssue TrackingTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-94051 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/949604 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/407980 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/407980/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 0717376 cowork_bench | <d943e75bc0fc8e3b27141979300cd8cbcd1e890d |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 20, 2026 | New CVE Received | [email protected] |