EUVD-2026-43722
GHSA-pm5p-7w5h-jm5q
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
PR:H reflects mandatory backend authentication; C:L reflects partial ~120-byte semi-blind response leakage; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind. Version 1.6.0 contains a patch.
AnalysisAI
Server-side request forgery in Easy!Appointments prior to 1.6.0 allows authenticated backend users - admins, providers, or secretaries - to probe internal network hosts by supplying arbitrary URLs to the CalDAV synchronization endpoint. The Guzzle HTTP client in Caldav.php:60 forwards a REPORT request to the caller-supplied caldav_url without validating the scheme or destination host, enabling access to loopback, RFC1918, and link-local addresses on the deployment network. The SSRF is semi-blind, returning up to approximately 120 bytes of upstream response body through the exception path; no public exploit has been identified, exploitation requires an active backend account, and version 1.6.0 resolves the issue.
Technical ContextAI
Easy!Appointments is a self-hosted PHP appointment scheduling application built on CodeIgniter. The vulnerable code resides in the CalDAV integration controller at application/controllers/Caldav.php, where connect_to_server passes the raw caller-supplied caldav_url parameter to the Guzzle HTTP client for a REPORT call at line 60. No scheme allowlist or host validation is applied before the request is dispatched, satisfying CWE-918 (Server-Side Request Forgery). The Guzzle exception handler at lines 74-78 echoes the upstream HTTP status code plus approximately 120 bytes of the response body back to the caller within a JSON message field, making this a semi-blind rather than fully blind SSRF. The affected CPE cpe:2.3:a:alextselegidis:easyappointments:*:*:*:*:*:*:*:* covers all versions prior to 1.6.0. The patch in commit 6eb9336a moved SSRF host validation into the Caldav_sync library itself, enabled by default, and removed the previously configurable Config::ENABLE_CALDAV_SSRF_CHECK toggle from config-sample.php.
RemediationAI
Upgrade Easy!Appointments to version 1.6.0, which introduces SSRF host validation directly within the Caldav_sync library with validation enabled by default. The fix is documented in commit 6eb9336a91cfb276379506625e81f5bd9ed3a536 at https://github.com/alextselegidis/easyappointments/commit/6eb9336a91cfb276379506625e81f5bd9ed3a536 and the security advisory at https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q. If an immediate upgrade is not feasible, implement network egress filtering on the application server to block outbound connections to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) addresses; this eliminates the internal network reach of the SSRF at the infrastructure layer without modifying application code, though it does not prevent SSRF against external targets. Additionally, enforce the principle of least privilege by auditing backend user accounts and removing secretary or provider accounts that do not require CalDAV access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today