What is the CVSS score of CVE-2026-41177?

CVE-2026-41177 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41177?

Yes, a patch is available for CVE-2026-41177. Update the affected software to the latest version immediately.

Squidex CVE-2026-41177

EUVD-2026-25110 MEDIUM

External Control of File Name or Path (CWE-73)

2026-04-22 GitHub_M

SSRF Squidex

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Apr 24, 2026 - 14:45 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:06 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25110

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:24 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied Url parameter, allowing the use of the file:// protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.

AnalysisAI

Blind Server-Side Request Forgery (SSRF) in Squidex prior to version 7.23.0 allows authenticated administrators to force the backend server to interact with the local filesystem via the file:// protocol in the Restore API's Url parameter, potentially disclosing sensitive system information through side-channel analysis of internal logs. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Squidex is an open-source headless content management system (CMS) built on .NET. The vulnerability exists in the Restore API endpoint, which accepts a user-supplied Url parameter intended for remote resource retrieval. The root cause is CWE-73 (External Control of File Name or Path), combined with inadequate URI scheme validation. The application fails to enforce a whitelist of safe protocols (e.g., HTTPS only), permitting the file:// URI scheme. This enables local file access when the backend HTTP client (likely .NET's HttpClient or similar) processes the malformed URI. The vulnerability is classified as Blind SSRF because the attacker cannot directly observe the file contents in the response; exploitation relies on side-channel techniques such as timing analysis or inference from internal log entries. The authentication requirement (PR:H - high privilege admin role) significantly narrows the attack surface, as it requires compromise or cooperation of administrative credentials.

RemediationAI

Upgrade Squidex to version 7.23.0 or later immediately. The vendor-released patch is confirmed by the GitHub commit b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 in the official repository. For organizations unable to patch immediately, implement network-level controls by restricting backend server egress: use an outbound firewall rule to block connections to 127.0.0.1/localhost, ::1, and other loopback/link-local addresses (169.254.0.0/16 on Windows), and deny file:// scheme requests at the API gateway or reverse proxy layer by enforcing HTTP/HTTPS-only validation. Additionally, conduct an audit of admin account holders and implement IP-allowlisting for administrative access to reduce the likelihood of credential compromise. Review audit logs from all Squidex instances running versions prior to 7.23.0 for suspicious Restore API calls with file:// or non-standard URIs. The patch is the definitive remediation; network controls are temporary mitigations only.