Apache Fesod CVE-2026-107460

Exploitation requires ALL of: (1) an application built on Fesod fesod-sheet 2.0.2-incubating that uses the UrlImageConverter to write images into spreadsheets from URLs; (2) remote URL image fetching enabled and accepting attacker-controlled/untrusted image URLs; and (3) the attacker controlling authoritative DNS responses for the supplied hostname to perform rebinding after the IP-validation check. Limiting factors that reduce realistic risk: the feature must be actively used with untrusted input (not a default of applications that only read or that supply trusted URLs), the attacker must win the validation-to-fetch time-of-check/time-of-use window, and 2.1.0-incubating disables remote fetching by default and enforces an exact-host allowlist, so patched/default-configured deployments are not exposed.

This is a moderate-severity Server-Side Request Forgery (SSRF) protection bypass in the UrlImageConverter of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating, exploitable via DNS rebinding. No CVSS vector, EPSS score, KEV listing, or public POC is present in the provided data, so quantitative exploitation signals are entirely absent - risk must be inferred from the description and vendor-assigned 'moderate' rating. The real-world priority is tempered by three factors: (1) the vulnerability is only reachable when an application built on Fesod accepts attacker-controlled image URLs for spreadsheet writing AND has remote URL image fetching enabled; (2) DNS rebinding requires the attacker to control authoritative DNS for the hostname and to win a time-of-check/time-of-use race between validation and the second connection, which raises attack complexity; and (3) the affected product is an Apache Incubator project with a limited deployment footprint. Conflicting/missing signals to note explicitly: no CVSS vector is supplied, so attack vector and privilege requirements are not vendor-confirmed and are inferred from the description only; exploitation status is unconfirmed (no KEV, no POC). This reads as a defense-in-depth bypass of an existing control (it bypasses the fix for CVE-2026-49328) rather than a mass-exploitable critical - a real but conditional issue, not an urgent widespread emergency.

An application uses Fesod to embed images into spreadsheets from user-supplied URLs with remote fetching enabled. An attacker submits a URL on a hostname they control; Fesod resolves it to a benign public IP and passes the SSRF validation, but on the subsequent fetch connection the attacker's DNS rebinds the hostname to an internal/restricted address (e.g., 169.254.169.254 or an internal service), causing the server to connect to it. No public exploit code is identified in the provided data, and the DNS-rebinding timing requirement gives this moderate attack complexity.