Is there a public PoC exploit available for CVE-2026-10771?

Yes, a public proof-of-concept exploit is available for CVE-2026-10771. Prioritise patching immediately. EPSS: 0.0%.

crmeb_java CVE-2026-10771

Q: What is the CVSS score of CVE-2026-10771?

CVE-2026-10771 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34182 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-03 VulDB

GHSA-8qxw-gwxm-v526

Java SSRF Crmeb Crmeb Java

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 22:36 vuln.today

Severity Changed

Jun 03, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Jun 03, 2026 - 22:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Server-side request forgery in crmeb_java 1.4 allows remote unauthenticated attackers to manipulate the base64 Qrcode endpoint's url parameter, causing the server to issue arbitrary outbound HTTP requests via Spring's RestTemplate.getForEntity. The affected component (RestTemplateUtil.java) passes attacker-controlled input directly to the HTTP client without URL validation or allowlisting, enabling internal network reconnaissance, cloud metadata service probing, and potential lateral movement. A public exploit has been disclosed via GitHub issue #35; no vendor patch exists as the project has not responded to the responsible disclosure report.

Technical ContextAI

The vulnerability resides in crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java within the crmeb_java e-commerce platform (a Java-based implementation of the CRMEB system). The base64 Qrcode endpoint - likely designed to fetch or decode a remote QR code image - accepts a url parameter and passes it without sanitization to Spring Framework's RestTemplate.getForEntity(), a synchronous HTTP client. CWE-918 (Server-Side Request Forgery) identifies the root cause: the application acts as an unintended HTTP proxy, issuing server-originated requests to attacker-specified destinations. The CPE cpe:2.3:a:crmeb:crmeb_java:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not bounded the affected range to a single release and additional versions may be impacted beyond the confirmed 1.4 baseline.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainers have not responded to the responsible disclosure submitted via GitHub issue #35 (https://github.com/crmeb/crmeb_java/issues/35). Until a patch is available, operators should implement URL allowlisting within RestTemplateUtil.java to restrict outbound requests to a known-safe set of external hosts; this eliminates SSRF but requires code modification and testing against legitimate QR code sources. As a network-layer control, block egress from the application server to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), the loopback address (127.0.0.1), and cloud metadata endpoints (169.254.169.254) - note this does not prevent SSRF against external third-party internal services. If the base64 Qrcode endpoint is not business-critical, disabling or gating it behind authentication is the most effective compensating control with minimal operational impact. Organizations running on cloud infrastructure should enforce IMDSv2 (requiring session-oriented token exchange) to prevent credential theft via SSRF against the instance metadata service.