Which versions of Squidex are affected by CVE-2026-41171?

Squidex versions prior to 7.23.0 contain a Server-Side Request Forgery vulnerability that allows authenticated users with schema editing permissions to extract cloud provider credentials and access…. A patch is available.

How to fix or mitigate CVE-2026-41171?

Within 24 hours: Identify all Squidex instances in your environment and document current versions. Within 7 days: Upgrade all Squidex deployments to version 7.23.0 or later; if immediate upgrade is not feasible, restrict schema editing permissions to only trusted administrators and disable Jint scripting engine if not actively required. Within 30 days: Conduct a security audit of any Squidex instances that ran unpatched versions to identify potential unauthorized access to cloud credentials or internal service access; rotate any cloud provider credentials and review CloudTrail/equivalent logs for suspicious API calls originating from Squidex systems.

Squidex CVE-2026-41171

Q: What is the CVSS score of CVE-2026-41171?

CVE-2026-41171 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25104 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-22 GitHub_M

SSRF Squidex

7.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 24, 2026 - 14:45 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 13:22 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:52 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

CVSS changed

Apr 22, 2026 - 22:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25104

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery (SSRF) vulnerability due to missing SSRF protection on the Jint HTTP client used by scripting engine functions (getJSON, request, etc.). An authenticated user with low privileges (e.g., schema editing permissions) can force the server to make arbitrary outbound HTTP requests to attacker-controlled or internal endpoints. This allows access to internal services and cloud metadata endpoints (e.g., IMDS), potentially leading to credential exposure and lateral movement. Version 7.23.0 contains a fix.

AnalysisAI

Server-Side Request Forgery (SSRF) in Squidex versions before 7.23.0 allows authenticated users with schema editing permissions to force the server to make arbitrary HTTP requests to internal services and cloud metadata endpoints through the Jint scripting engine. The vulnerability can expose cloud provider credentials (e.g., AWS IMDS) and enable lateral movement within internal networks. Exploitation requires only low-privilege authentication (PR:L) and has publicly available exploit code (E:P in CVSS 4.0 vector). Vendor-confirmed patch available in version 7.23.0.

Technical ContextAI

Squidex is an open-source headless CMS built on .NET that provides a scripting engine for content transformations and integrations. The scripting engine exposes JavaScript functions (getJSON, request) powered by the Jint JavaScript interpreter, which includes an HTTP client for making outbound requests. The vulnerability stems from insufficient SSRF protection in this HTTP client implementation. CWE-918 (SSRF) occurs when applications accept user-controlled URLs without proper validation, allowing attackers to specify internal network addresses or cloud metadata endpoints (169.254.169.254 for AWS/Azure/GCP IMDS) that the server then accesses with its own network context and credentials. The affected component is the scripting engine's HTTP client functions accessible to users with schema editing permissions. CPE cpe:2.3:a:squidex:squidex identifies all Squidex versions prior to 7.23.0 as affected.

RemediationAI

Upgrade to Squidex version 7.23.0 or later, which includes SSRF protection for the Jint HTTP client as documented in GitHub commit b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 (https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4). Vendor security advisory GHSA-4m22-gvqm-jv97 confirms fix availability (https://github.com/Squidex/squidex/security/advisories/GHSA-4m22-gvqm-jv97). If immediate upgrade is not feasible, implement network-level controls: block outbound HTTP/HTTPS from Squidex application servers to RFC1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16 to prevent IMDS access), and localhost (127.0.0.0/8), using egress firewall rules or security groups. Note this breaks legitimate use cases if scripts require accessing internal APIs. Alternatively, restrict schema editing permissions to only highly trusted administrators until patching is complete, reducing the attack surface but limiting CMS functionality for content teams. Monitor outbound HTTP requests from Squidex processes for suspicious internal destinations as a detection control.