Which versions of Squidex are affected by CVE-2026-41172?

Squidex CMS versions before 7.23.0 contain a server-side request forgery vulnerability that allows authenticated users with asset upload permissions to retrieve internal network resources and cloud…. A patch is available.

How to fix or mitigate CVE-2026-41172?

Within 24 hours: Identify all Squidex deployments and their current versions using asset management records. Within 7 days: Upgrade Squidex to version 7.23.0 or later per vendor advisory GHSA-x7cq-4f4c-8qcv; test in non-production first. Within 30 days: Review audit logs for unauthorized asset uploads by authenticated users since deployment and audit IAM credentials for exposure.

Squidex CVE-2026-41172

Q: What is the CVSS score of CVE-2026-41172?

CVE-2026-41172 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25106 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-22 GitHub_M

SSRF Squidex

7.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 24, 2026 - 14:45 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 13:22 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:52 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

CVSS changed

Apr 22, 2026 - 22:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25106

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:22 nvd

HIGH 7.3

DescriptionGitHub Advisory

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.

AnalysisAI

Server-Side Request Forgery in Squidex versions prior to 7.23.0 allows authenticated users with asset upload permissions to force the CMS server to fetch arbitrary URLs, including internal network resources and localhost endpoints, storing the retrieved content as platform assets. This enables reconnaissance of internal infrastructure, exfiltration of cloud metadata endpoints (AWS/Azure credentials), and access to services not exposed to the internet. CVSS 7.3 (High) with CVSS 4.0 E:P (Proof-of-concept exists). Vendor patch available in version 7.23.0 per GitHub security advisory GHSA-x7cq-4f4c-8qcv.

Technical ContextAI

This vulnerability affects Squidex, an open-source headless CMS built on .NET. The SSRF (CWE-918) exists in the asset upload functionality where user-supplied URLs are processed without sufficient validation of the target destination. The application's server-side code fetches resources from attacker-controlled URLs and persists the response content as assets within the CMS. According to CPE cpe:2.3:a:squidex:squidex:*:*:*:*:*:*:*:*, all versions before 7.23.0 are vulnerable. CWE-918 (Server-Side Request Forgery) represents insufficient restriction on the destination of network requests, allowing attackers to abuse the server's network position and trusted relationships. In cloud environments, SSRF commonly targets metadata services (169.254.169.254) to extract credentials. In containerized deployments, internal service meshes and orchestration APIs become accessible attack surfaces.

RemediationAI

Upgrade to Squidex version 7.23.0 or later, which contains the vendor-released patch per GitHub security advisory GHSA-x7cq-4f4c-8qcv. The fix is implemented in commit b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 available at https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4. For environments unable to immediately upgrade, implement network-level egress filtering to restrict the Squidex server's outbound connections: block access to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and internal service discovery endpoints. Trade-off: egress filtering may break legitimate external asset fetching from CDNs or third-party services - maintain an allowlist of required external domains. Additionally, apply principle of least privilege by auditing which user roles have asset upload permissions and restricting to only essential accounts. Note this workaround does not prevent SSRF to public internet targets and provides incomplete protection.