Client St0r CVE-2026-112254

Requires an authenticated session on Client St0r - pre-patch, any logged-in member including a read-only account - reaching the POST /locations/<id>/import-property-from-url/ endpoint backed by _fetch_html in the Property URL Importer. The attacker supplies a URL that the server fetches with a plain requests.get() whose only validation was an http:// or https:// prefix; redirects and proxy environment variables were honoured, allowing requests to 127.0.0.1, RFC1918 ranges, 169.254.169.254 and other routable internal hosts, with failure exception text echoed back. Exploitation is LIMITED by the need for valid account credentials (no anonymous access) and by the importer feature being present (shipped since v2.11.4); it does not require any special non-default configuration.

This is a genuine but moderate-severity SSRF (CWE-918) rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium): network-reachable, low attack complexity, but it requires authentication (PR:L) and yields only low confidentiality impact with no integrity or availability impact. The source-code evidence confirms the real-world risk profile: any logged-in member - including a read-only one, pre-patch - could coerce the server into requesting 127.0.0.1, RFC1918 hosts, or the 169.254.169.254 cloud metadata endpoint, and exception text was echoed back, enabling limited blind/semi-blind internal reconnaissance and potential metadata/credential theft in cloud deployments. On exploitation signals the picture is consistent: the CVSS 4.0 string carries E:P (Proof-of-Concept) and the description states 'the exploit has been made public,' so publicly available exploit code exists. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation. The dominant risk-reducing factor is prevalence: this is an obscure, single-maintainer GitHub project with negligible enterprise footprint. Net: real and patchable, but a low operational priority for most organizations unless they actually run this product.

An attacker with any valid low-privilege account (pre-patch, even a read-only member) submits a crafted URL such as http://169.254.169.254/latest/meta-data/ to the Property URL Importer endpoint. The server-side _fetch_html function performs a plain requests.get() that follows redirects and ignores IP-range restrictions, so it fetches the internal/metadata resource and leaks response or exception details back to the attacker. Public exploit code exists, and the low attack complexity makes this trivially reproducible against any exposed instance.