EUVD-2026-16525
GHSA-5j4w-5v7w-7fvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was identified in Page-Replica Page Replica up to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0. The impacted element is the function sitemap.fetch of the file /sitemap of the component Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Page-Replica endpoint /sitemap improperly validates the url parameter in the sitemap.fetch function, enabling server-side request forgery (SSRF) attacks by authenticated users. An attacker with login credentials can craft malicious requests to make the vulnerable server fetch arbitrary internal or external resources, potentially exposing sensitive data or facilitating lateral movement. The vulnerability affects all versions up to commit e4a7f52e75093ee318b4d5a9a9db6751050d2ad0 under the product's rolling release model, with publicly available exploit code and an EPSS score indicating elevated exploitation probability, though the vendor has not responded to early disclosure.
Technical ContextAI
The vulnerability resides in CWE-918 (Server-Side Request Forgery), a class of flaws where server-side code fetches remote resources based on user-supplied input without proper validation. In Page-Replica (cpe:2.3:a:page-replica:page_replica:*:*:*:*:*:*:*:*), the /sitemap endpoint's sitemap.fetch function accepts a url parameter that is passed directly to a resource-fetching mechanism (likely HTTP client or URL parser) without sanitizing, validating, or restricting the target domain. This allows attackers to redirect requests to internal services (metadata endpoints, databases, admin panels), private IP ranges, or external systems to exfiltrate data or probe infrastructure. The rolling release strategy complicates version tracking and patching timelines.
RemediationAI
No vendor-released patch version has been independently confirmed at the time of analysis; however, users should monitor the Page-Replica repository for commits addressing input validation in the /sitemap endpoint and upgrade to any released versions containing the fix. As an interim mitigation, restrict network access to the /sitemap endpoint via network firewall rules or reverse-proxy authentication policies, allowing only trusted internal or administrative users to invoke sitemap operations. Implement a Web Application Firewall (WAF) rule to block requests to the /sitemap endpoint containing internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16) or metadata service URLs (e.g., 169.254.169.254). Audit access logs for suspicious /sitemap requests and review user account permissions. For critical deployments, disable the /sitemap endpoint entirely if not required, or deploy behind a reverse proxy that validates and whitelists the url parameter against a safe-list of allowed domains. Monitor VulDB (https://vuldb.com/?submit.777447) and the exploit reference (https://github.com/lakshayyverma/CVE-Discovery/blob/main/page_replica.md) for patch announcements.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today