EUVD-2026-29853Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Editor role is required (PR:L); server fetches cross-boundary internal targets (S:C); only limited HTTP probing possible, no integrity or availability impact (C:L/I:N/A:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and does not restrict private or loopback destinations, this becomes a stored SSRF primitive that can be turned into an internal HTTP probing oracle. This vulnerability is fixed in 1.4.13.
AnalysisAI
Stored SSRF in mosparo's automatic rule package source URL feature allows a project editor to plant an attacker-controlled URL that the mosparo server subsequently fetches without restricting private or loopback destinations. Any authenticated project member with the editor role can exploit this to probe internal HTTP services behind the mosparo host, effectively turning the application into a network reconnaissance oracle. A publicly available proof-of-concept exists per SSVC data; however, the vulnerability is not listed in CISA KEV and carries a very low EPSS of 0.03%, suggesting no observed widespread exploitation at time of analysis.
Technical ContextAI
mosparo (cpe:2.3:a:mosparo:mosparo:*:*:*:*:*:*:*:*) is a PHP-based spam-protection platform for web forms. The automatic rule package feature allows administrators and editors to configure a remote URL from which the server periodically fetches updated spam-filtering rule sets. The root cause (CWE-918: Server-Side Request Forgery) stems from the server's HTTP client following redirects without enforcing an allowlist of permitted destination IP ranges or hostnames. Because private RFC-1918 addresses (10.x.x.x, 172.16.x.x, 192.168.x.x) and loopback (127.0.0.1/::1) are not blocked, an editor-supplied URL can chain through one or more redirects to reach otherwise firewalled internal services. The CVSS scope-change metric (S:C) is consistent with this pattern: the fetching originates in the mosparo application boundary but impacts resources outside it (internal infrastructure).
RemediationAI
Upgrade mosparo to version 1.4.13, which is confirmed as the vendor-released fix per the GitHub Security Advisory GHSA-92fh-26qf-r8rg. The fix should enforce an allowlist or denylist on the rule package source URL resolver to block redirects targeting RFC-1918 private ranges, loopback addresses, link-local addresses (169.254.x.x), and other non-routable destinations. If immediate upgrade is not possible, restrict the editor role assignment to fully trusted personnel only, as the SSRF is only reachable by authenticated users with that role - removing editor access from untrusted parties eliminates the attack surface without any other configuration change. Additionally, placing mosparo behind a network egress proxy that enforces destination allowlisting provides a defense-in-depth compensating control, though it does not fix the underlying flaw and may break legitimate rule-fetching functionality if not carefully scoped.
Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. Rated high severity (CVSS 8.8), t
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. Rated medium severity (CVSS 6.1), this vulnerability
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today