EUVD-2026-38072Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring low-privilege configure permission (PR:L) enables full internal network reconnaissance (C:H, S:C) and conditional integrity impact on internal services via gopher payloads (I:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (/admin/config/parameters). The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the Mercator server to issue arbitrary outbound network requests. The suffix /api/dbInfo appended to the URL can be bypassed by injecting a # fragment character (e.g. http://TARGET/PATH#), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The telnet:// scheme can be used for internal port scanning; the gopher:// scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
AnalysisAI
Server-Side Request Forgery in Mercator's CVE configuration panel allows authenticated users holding the low-privilege 'configure' permission to coerce the application server into issuing arbitrary outbound network requests to any internal or external host. Affected versions prior to 2025.05.19 pass user-supplied URLs directly to curl_init() in ConfigurationController::testProvider() with no scheme, hostname, or private-IP validation; the intended /api/dbInfo suffix restriction is trivially defeated by appending a
fragment character, granting full URL control. Support for the telnet:// scheme enables internal TCP port scanning, while gopher:// permits raw protocol-level interaction with unauthenticated internal services such as Redis and Memcached, creating a realistic path to Remote Code Execution on those systems under common deployment conditions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Mercator (CPE: cpe:2.3:a:sourcentis:mercator:*:*:*:*:*:*:*:*) is a PHP-based open source web application for information system mapping maintained by sourcentis. The vulnerability is rooted in CWE-918 (Server-Side Request Forgery): the server's HTTP client - PHP's libcurl - is weaponized to act as a network proxy on behalf of an attacker-controlled URL. ConfigurationController::testProvider() constructs a URL by concatenating user input with /api/dbInfo and passing the result to curl_init() without any allow-list validation. A URL fragment character (#) exploits the semantic gap between PHP string concatenation and curl's URL parsing: curl treats everything after
as a fragment and ignores it, neutralizing the forced suffix. Because curl supports multiple URL schemes beyond HTTP and HTTPS, the attacker can leverage telnet:// for blind TCP banner-grabbing against internal hosts, and gopher:// - a legacy protocol fully supported by curl - to inject raw byte payloads directly into unauthenticated Redis (port 6379) or Memcached (port 11211) instances. When Redis is reachable without authentication, gopher:// payloads can write arbitrary data to disk (e.g., a cron job or authorized_keys file), escalating SSRF to full Remote Code Execution on the internal Redis host.
RemediationAI
Vendor-released patch: Mercator version 2025.05.19, which addresses the SSRF by adding validation inside ConfigurationController::testProvider(). Administrators should upgrade to 2025.05.19 or later immediately; the advisory is at https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6. If immediate patching is blocked, apply the following compensating controls in order of priority: first, restrict network-level access to /admin/config/parameters to administrator-only roles at the reverse proxy or WAF layer, reducing the exploitable population to highest-trust users; second, configure egress filtering on the Mercator host to block outbound connections to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback interface, which mitigates internal pivoting but may affect legitimate provider connectivity; third, require authentication on all internal Redis and Memcached instances (Redis requirepass directive; Memcached -l localhost binding), which eliminates the RCE escalation path even if SSRF occurs. Note that blocking RFC 1918 egress may break Mercator functionality if it legitimately communicates with on-premises CVE data providers.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today