Squidex CVE-2026-41172

Exploitation requires authenticated access with asset upload permissions in Squidex. The vulnerability is exploitable in default configurations where the asset upload feature processes user-supplied URLs without destination validation. Attack requires PR:L (low privileges) - specifically a user account with role permissions for creating or uploading assets, typically granted to content editors, media managers, or administrator roles. No user interaction required (UI:N). Network accessibility (AV:N) means exploitation works remotely over HTTP/HTTPS. Exploitation is NOT limited by special deployment configurations - affects all installation modes (bare metal, Docker, Kubernetes, cloud platforms). Limitation: attacker must have valid authenticated credentials; purely external unauthenticated attackers cannot exploit this SSRF. Internal network topology and presence of sensitive services on localhost/private IPs determines actual impact severity - cloud deployments with metadata endpoints face higher risk than isolated on-premise installations.

Real-world risk is HIGH for multi-tenant Squidex deployments and cloud-hosted instances. CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation requiring low-complexity attack from authenticated users - a realistic threat model since content editors routinely have asset upload permissions. The E:P modifier confirms proof-of-concept availability. However, PR:L (low privileges required) and the need for specific upload permissions reduces attack surface compared to unauthenticated vulnerabilities. SSRF tag and CWE-918 classification indicate attackers can pivot to internal networks, cloud metadata endpoints, and localhost services (databases, admin panels, container orchestration APIs). Scope unchanged (SC:N/SI:N/SA:N) means exploitation is contained to the Squidex instance itself, but VC:H/VI:H indicates high confidentiality and integrity impact within that scope - attackers read internal resources and persist malicious content as trusted assets. Not present in CISA KEV, suggesting no widespread campaign exploitation observed. EPSS data not provided but typical SSRF vulnerabilities in CMS platforms show moderate exploitation probability when user accounts are compromised. Primary risk: cloud credential theft via metadata endpoints, internal network mapping, and access to services trusting requests from the CMS server IP. Secondary risk: stored malicious content delivery to end users via uploaded assets.

An attacker with valid Squidex credentials and asset upload permissions crafts a malicious asset upload request containing a URL pointing to the cloud metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The Squidex server fetches the URL, retrieves AWS IAM credentials, and stores the response as an asset. The attacker downloads the asset through the CMS interface, obtaining temporary AWS credentials that grant access to cloud resources associated with the server's IAM role. Alternatively, the attacker targets internal services (http://localhost:8080/admin, http://internal-db:5432) to map the internal network topology and access administrative interfaces not exposed to the internet.