TiBillet Lespass CVE-2026-112358

Requires an authenticated attacker with high privileges (PR:H) on the TiBillet Lespass v1 API, and the ability to supply the img_url or image_url argument to one of the three affected APIv1 serializers that call get_img_from_url. Exploitation is explicitly difficult (AC:H): the server-side fetch lacks destination IP validation, redirect re-checks, and download timeout/size limits, so an attacker must craft URLs (and likely abuse redirects) to reach internal targets. Limiting factors: high-privilege authentication is mandatory, attack complexity is high, impact is Low across C/I/A with no scope change, and the vulnerable v1 endpoints are deprecated and scheduled for removal - reducing the realistic exposure window.

This is a low-priority issue despite being a real, vendor-confirmed vulnerability. The CVSS 4.0 base score of 2.1 is consistent across every signal: the vector (AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) shows network reachability but high attack complexity, a requirement for high privileges (PR:H), and only Low impact to confidentiality, integrity, and availability with no scope/subsequent-system change. The vendor itself characterizes exploitability as 'difficult.' No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit (POC) is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The sole source is a VulDB submission (CVE-2026-112358 / vuldb.com/vuln/422393); there is no independent vendor advisory URL, though the vendor statement about a planned v2 fix is quoted. No signals conflict: all of them (low CVSS, high complexity, authenticated-only access, low impacts, no exploitation evidence) point in the same direction. The one caveat is that SSRF class flaws (CWE-918) can sometimes enable higher impact (internal network pivoting, cloud metadata access) than a Low-impact rating suggests, but the quoted vendor mitigations (destination IP validation, redirect re-checks) and the AC:H/PR:H gating make broad exploitation unlikely. Treat as low urgency; the affected v1 API is already slated for removal.

An attacker who already holds a high-privileged authenticated account on a TiBillet Lespass v1 API deployment submits a crafted img_url/image_url value to an APIv1 serializer endpoint, causing the server's get_img_from_url function to fetch an attacker-chosen URL and reach internal services the attacker cannot normally access. Because the vendor rates exploitability as difficult (AC:H) and no destination-IP validation bypass is trivial, the attacker likely needs redirect tricks and careful targeting; impact is limited (Low C/I/A). No public exploit code is referenced at the time of analysis.