EUVD-2026-76766Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-exploitable SSRF requiring only low-privilege asset:import permission; C:H from IMDS credential access potential; A:L from unbounded response buffering; S:U as the server's own network context is the affected system.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted fetch() request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.
AnalysisAI
Server-Side Request Forgery in Shelf (shelf.nu) asset-tracking platform before v1.20.3 allows authenticated users holding the asset:import permission to force the application server to make unrestricted outbound HTTP requests by supplying crafted imageUrl values inside a CSV import file. Multiple documented bypass techniques - including image-extension suffixes, redirect chains, and domain substring matching - allow the weak URL validation to be circumvented, after which the server executes an unguarded fetch() call. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Shelf user account with the `asset:import` permission and the ability to initiate a CSV import via the Asset CSV Content Import feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) accurately reflects network-accessible SSRF gated only by a low-privilege authenticated session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Shelf to version 1.20.3, which patches the SSRF vulnerability as documented in GitHub Security Advisory GHSA-xgrm-8w6v-mvjg (https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-xgrm-8w6v-mvjg). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Shelf deployments and document current versions; restrict asset import permissions to senior administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today