EUVD-2026-38072Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate with configure permission
-
DeliverySubmit crafted gopher:// URL with # fragment to /admin/config/parameters
-
ExploitServer passes URL to curl_init() without validation
-
Installcurl connects to internal Redis on port 6379
-
C2Inject raw Redis commands via gopher payload
-
ExecuteWrite cron job to Redis host filesystem
-
ImpactAchieve RCE on internal service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Mercator session where the user account holds the explicitly granted 'configure' permission - this is a non-default, operator-assigned privilege, not a permission held by all authenticated users. The attacker must have network access to the /admin/config/parameters endpoint, which is an admin panel and may be restricted by network segmentation in hardened deployments. The fragment character injection is required to neutralize the /api/dbInfo suffix and achieve full URL control over the curl request. Escalation from SSRF to Remote Code Execution is conditional on the existence of an unauthenticated Redis or Memcached instance reachable from the Mercator server's network interface - without such a service, impact is limited to internal HTTP/TCP reconnaissance and potential access to other internal web APIs. The CVSS PR:L metric confirms that unauthenticated exploitation is not possible; an active session with the configure permission is a hard prerequisite. |
| Impact | The provided CVSS 4.0 score of 5.3 with SC:L/SI:N/SA:N materially understates real-world risk: the CVE description and tags ('RCE', 'Redis') explicitly confirm that subsequent-system RCE is achievable, not merely theoretical - SC:L and SI:N do not reflect the gopher-to-Redis code execution path. Independent assessment places subsequent-system confidentiality and integrity impact significantly higher. The authentication barrier is PR:L (a 'configure' permission that is explicitly granted but is not the administrator role), which lowers the effective attacker pool but does not eliminate risk in organizations with many Mercator users. The fragment bypass is simple and requires no specialized tooling. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no confirmed public proof-of-concept suggests this is not currently under mass exploitation, but the gopher-to-Redis RCE technique is extensively documented in SSRF research and can be reproduced by any skilled attacker from public knowledge. The primary risk vector is insider or low-privilege attacker performing internal network reconnaissance and lateral movement to unauthenticated internal services - a high-value path in environments where Redis or Memcached run without authentication, which is a widespread default configuration. |
| Exploit ScenarioDerived | An attacker holding a Mercator account with the 'configure' permission navigates to /admin/config/parameters and submits a crafted URL such as gopher://192.168.1.50:6379/_%0D%0ASET%20... followed by a fragment, bypassing the /api/dbInfo suffix enforcement. The Mercator server's curl client sends the gopher payload directly to the internal Redis instance, which - running without authentication - interprets the embedded commands and writes an attacker-controlled cron job to the filesystem, resulting in remote code execution on the internal Redis host. No confirmed public proof-of-concept exists at time of analysis, but the gopher-to-Redis SSRF escalation technique is thoroughly documented in public security research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 19, 2026
Server-Side Request Forgery in Mercator's CVE configuration panel allows authenticated users holding the low-privilege 'configure' permission to coerce the application server into issuing arbitrary outbound network requests to any internal or external host. Affected versions prior to 2025.05.19 pass user-supplied URLs directly to curl_init() in ConfigurationController::testProvider() with no scheme, hostname, or private-IP validation; the intended /api/dbInfo suffix restriction is trivially defeated by appending a
fragment character, granting full URL control. Support for the telnet:// scheme enables internal TCP port scanning, while gopher:// permits raw protocol-level interaction with unauthenticated internal services such as Redis and Memcached, creating a realistic path to Remote Code Execution on those systems under common deployment conditions. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patch: Mercator version 2025.05.19, which addresses the SSRF by adding validation inside ConfigurationController::testProvider(). Administrators should upgrade to 2025.05.19 or later immediately; the advisory is at https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6. If immediate patching is blocked, apply the following compensating controls in order of priority: first, restrict network-level access to /admin/config/parameters to administrator-only roles at the reverse proxy or WAF layer, reducing the exploitable population to highest-trust users; second, configure egress filtering on the Mercator host to block outbound connections to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback interface, which mitigates internal pivoting but may affect legitimate provider connectivity; third, require authentication on all internal Redis and Memcached instances (Redis requirepass directive; Memcached -l localhost binding), which eliminates the RCE escalation path even if SSRF occurs. Note that blocking RFC 1918 egress may break Mercator functionality if it legitimately communicates with on-premises CVE data providers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mercator (CPE: cpe:2.3:a:sourcentis:mercator:*:*:*:*:*:*:*:*) is a PHP-based open source web application for information system mapping maintained by sourcentis. The vulnerability is rooted in CWE-918 (Server-Side Request Forgery): the server's HTTP client - PHP's libcurl - is weaponized to act as a network proxy on behalf of an attacker-controlled URL. ConfigurationController::testProvider() constructs a URL by concatenating user input with /api/dbInfo and passing the result to curl_init() without any allow-list validation. A URL fragment character (#) exploits the semantic gap between PHP string concatenation and curl's URL parsing: curl treats everything after
as a fragment and ignores it, neutralizing the forced suffix. Because curl supports multiple URL schemes beyond HTTP and HTTPS, the attacker can leverage telnet:// for blind TCP banner-grabbing against internal hosts, and gopher:// - a legacy protocol fully supported by curl - to inject raw byte payloads directly into unauthenticated Redis (port 6379) or Memcached (port 11211) instances. When Redis is reachable without authentication, gopher:// payloads can write arbitrary data to disk (e.g., a cron job or authorized_keys file), escalating SSRF to full Remote Code Execution on the internal Redis host.
Know when Mercator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Network-accessible SSRF requiring low-privilege configure permission (PR:L) enables full internal network reconnaissance (C:H, S:C) and conditional integrity impact on internal services via gopher payloads (I:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (/admin/config/parameters). The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user with the configure permission can force the Mercator server to issue arbitrary outbound network requests. The suffix /api/dbInfo appended to the URL can be bypassed by injecting a # fragment character (e.g. http://TARGET/PATH#), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The telnet:// scheme can be used for internal port scanning; the gopher:// scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Authorization bypass in Mercator information system mapping application prior to version 2025.05.19 allows any authentic
Stored XSS in Mercator prior to version 2026.02.22 allows authenticated users to execute arbitrary JavaScript in other u
Exploit-DB