EUVD-2026-33670
GHSA-4mj2-2x8x-85xv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in indrasishbanerjee aem-mcp-server up to b5f833aef9b5dfd17a5991b3b18a8a11edbdc583. This impacts the function getAssetMetadata of the file src/mcp-server.ts of the component Axios Request Flow. Executing a manipulation of the argument assetPath can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in indrasishbanerjee aem-mcp-server allows authenticated remote attackers with low privileges to manipulate the assetPath argument of the getAssetMetadata function, causing the server's Axios HTTP client to issue arbitrary outbound requests. All code up to commit b5f833aef9b5dfd17a5991b3b18a8a11edbdc583 is affected; the project uses no versioning scheme, making version-based scoping impossible. Publicly available exploit code exists (GitHub issue #3), though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of only 2.1 due to limited impact scope and an authentication prerequisite.
Technical ContextAI
aem-mcp-server is an open-source Model Context Protocol (MCP) server designed to interface with Adobe Experience Manager (AEM) assets. The vulnerable component is the getAssetMetadata function in src/mcp-server.ts, which constructs and dispatches HTTP requests using the Axios library without adequately validating or sanitizing the caller-supplied assetPath parameter. CWE-918 (Server-Side Request Forgery) describes this root cause: the application acts as an unintended HTTP proxy, forwarding requests to attacker-controlled destinations - which may include internal network endpoints, cloud metadata services (e.g., 169.254.169.254), or other backend systems not exposed to the public internet. The affected CPE is cpe:2.3:a:indrasishbanerjee:aem-mcp-server:*:*:*:*:*:*:*:*, encompassing all tracked revisions.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer had not responded to the disclosure as of the reporting date. Operators should apply compensating controls until a fix is confirmed. The most effective mitigation is to implement strict server-side allowlisting of permitted URL schemes, hosts, and ports within the getAssetMetadata Axios request flow, rejecting any assetPath value that does not resolve to an approved AEM instance - this directly breaks the SSRF primitive with minimal functional side effects. Additionally, configure egress firewall rules on the host running aem-mcp-server to block outbound HTTP/HTTPS to RFC-1918 private ranges and well-known cloud metadata endpoints (e.g., 169.254.169.254, 169.254.170.2), accepting that this may prevent legitimate communication with internal AEM nodes if those overlap with blocked ranges. Restricting access to the MCP server endpoint to only trusted, authenticated users reduces the attack surface consistent with the PR:L prerequisite. Monitor the project repository at https://github.com/indrasishbanerjee/aem-mcp-server/ and VulDB entry https://vuldb.com/vuln/367553 for patch availability.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today