Which versions of Squidex are affected by CVE-2026-41170?

Squidex versions prior to 7.23.0 contain a server-side request forgery vulnerability in the backup restoration endpoint that allows authenticated administrators to probe internal network services and…. A patch is available.

How to fix or mitigate CVE-2026-41170?

Within 24 hours: Identify all Squidex instances and document current versions. Within 7 days: Upgrade all affected Squidex deployments to version 7.23.0 or later; conduct access review of admin accounts with backup restoration privileges. Within 30 days: Implement network segmentation to restrict application-layer HTTP client access to internal services; deploy egress filtering rules to prevent metadata service access from Squidex servers.

Squidex CVE-2026-41170

Q: What is the CVSS score of CVE-2026-41170?

CVE-2026-41170 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25102 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-22 GitHub_M

SSRF Squidex

7.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 24, 2026 - 14:45 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 16:27 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:55 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

CVSS changed

Apr 22, 2026 - 22:22 NVD

7.2 (HIGH)

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25102

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:13 nvd

HIGH 7.2

DescriptionGitHub Advisory

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the RestoreController.PostRestoreJob endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient without any SSRF protection. A malicious or compromised admin can use this endpoint to probe internal network services, access cloud metadata endpoints, or perform internal reconnaissance. The vulnerability is authenticated (Admin-only) but highly impactful, allowing potential access to sensitive internal resources. Version 7.23.0 contains a fix.

AnalysisAI

Server-Side Request Forgery in Squidex's backup restoration endpoint allows authenticated administrators to probe internal network services and access cloud metadata endpoints. The RestoreController.PostRestoreJob endpoint accepts arbitrary URLs without SSRF protection, enabling internal reconnaissance through the application's HTTP client. Exploitation requires high privileges (admin authentication) but grants access to confidential internal resources and sensitive cloud service metadata. Version 7.23.0 patches this vulnerability. EPSS exploitation probability and active exploitation status are not reported in available intelligence.

Technical ContextAI

Squidex is an open-source headless CMS built on .NET that provides content management capabilities through RESTful APIs. The vulnerability exists in the backup restoration mechanism where the RestoreController.PostRestoreJob endpoint processes administrator-supplied URLs to download backup archives. This endpoint uses a dedicated 'Backup' HttpClient instance that lacks SSRF protections such as URL allowlisting, private IP range blocking, or metadata endpoint filtering. CWE-918 (Server-Side Request Forgery) represents a trust boundary violation where user-controlled input dictates backend HTTP requests, allowing attackers to pivot the application server as a proxy for accessing network resources that should be unreachable from the attacker's position. In cloud deployments (AWS, Azure, GCP), this commonly targets metadata services at 169.254.169.254 to extract credentials, API keys, and service tokens.

RemediationAI

Upgrade to Squidex version 7.23.0 or later, which contains the fix implemented in commit b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 (https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4). Review the GitHub Security Advisory GHSA-6q6m-7h5j-jq4g for complete vendor guidance. If immediate patching is not feasible, implement network-level egress filtering to block access from the Squidex application server to internal RFC1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16 - critical for blocking cloud metadata services), and other sensitive internal CIDR blocks specific to your environment. Note that egress filtering may break legitimate external backup storage integrations, requiring allowlisting for trusted backup repositories. Restrict RestoreController endpoint access through additional application-level controls or web application firewall rules requiring multi-factor authentication for backup operations. Audit existing administrator accounts and review access logs for the PostRestoreJob endpoint to identify potential prior exploitation attempts targeting internal IP ranges or metadata endpoints.