EUVD-2026-108748Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as curator-role user
-
DeliverySubmit bracketed IPv6 import URL
-
ExploitBypass isUrlSafe SSRF guard
-
ExecutionImportCuratorEvents fetches internal service
-
ImpactInternal response exfiltrated via imported events
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account that owns a curator role, which grants access to supply import_urls via the role update flow (RoleController, authorize('update',$role)); isUrlSafe() then validates and stores the attacker URL, and ImportCuratorEvents later fetches it. No special non-default server configuration is needed - the flaw is in the default URL-safety guard itself. Two concrete trigger forms are confirmed: (1) a bracketed IPv6 literal (e.g. http://[::1]:6379/, http://[fc00::1]/, http://[::ffff:7f00:1]/, http://[64:ff9b::a9fe:a9fe]/) which bypasses every check because parse_url retains the brackets; and (2) a hostname with only an AAAA record (or a dual-stack host enabling DNS rebinding), because the gethostbyname A-only resolver fails open. The primary limiting factor is the curator-role authentication requirement, which restricts this to semi-trusted insiders or compromised curator accounts rather than fully anonymous attackers. |
| Impact | This is a CWE-918 SSRF rated CVSS 6.5 (medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The signals are mostly consistent and point to a real-but-bounded priority rather than an emergency. AV:N and AC:L make the bypass itself trivial to trigger, but PR:L is the decisive limiter: the advisory confirms exploitation requires an authenticated user holding a curator role who can submit import_urls through the role update flow (RoleController, authorize('update',$role)). KEV status is NO - there is no CISA KEV listing - and no EPSS score was provided in the input, so exploitation-probability cannot be quantified. A public PoC reference exists in the advisory (logic ported verbatim to poc/OUTPUT.txt) but it is not verified as working, weaponized exploit code. The vuln.today decision label is 'this_month', consistent with a medium-severity, authentication-gated flaw rather than act_now/emergency. The impact profile is genuine: this is non-blind SSRF (internal-service responses are parsed and surfaced back in the user's events) and can reach localhost Redis, ULA/link-local addresses, and cloud metadata (169.254.169.254 via a NAT64 literal), yet C:H/I:N/A:N correctly reflects read-oriented impact. The most aggravating factor is that there is no patch at time of publication, so exposure persists for any deployment that grants curator roles to semi-trusted users. |
| Exploit ScenarioDerived | An authenticated user holding a curator role submits an import URL such as http://[::1]:6379/ or http://[64:ff9b::a9fe:a9fe]/ (NAT64 to 169.254.169.254) through the role update flow. Because parse_url keeps the brackets, isUrlSafe() fails to recognize the IPv6 literal and returns true, so ImportCuratorEvents fetches the internal target via Http::get and parses the response into events, surfacing internal-service data back to the attacker. A public PoC reference demonstrating the bypass logic exists in the advisory, though it is not verified as a working end-to-end exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
Server-side request forgery in the open-source Event Schedule platform (versions 1.0.0 and earlier) lets an authenticated user who holds a curator role store a crafted import URL that defeats the App\Utils\UrlUtils::isUrlSafe() guard, so the application later fetches internal or localhost services via ImportCuratorEvents and imports the response body as event data. Two bypasses are documented: bracketed IPv6 literals that parse_url leaves un-normalized, and an A-record-only resolver that fails open for AAAA-only or rebindable hostnames. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is limited by the curator-role requirement; no vendor-released patch was identified at time of analysis, and a public PoC reference (ported guard logic with sample outputs) accompanies the advisory.
RemediationAI
No vendor-released patch was identified at time of analysis; the project states there are no publicly available patches, so remediation is currently code-level or compensating. Apply the upstream fix guidance from GHSA-664j-55hw-p8fm (https://github.com/eventschedule/eventschedule/security/advisories/GHSA-664j-55hw-p8fm): strip the surrounding square brackets from $host before the IPv6 checks, or parse with a helper that normalizes IPv6 hosts into their canonical binary form and classify that form by range; resolve both A and AAAA records and fail closed when resolution fails instead of skipping the check; and pin the validated IP for the actual request (for example CURLOPT_RESOLVE or a bound resolver) so the fetch cannot re-resolve, which also closes the DNS-rebinding path. Until code changes are deployed, restrict curator-role assignment to accounts that are genuinely trusted and review existing import_urls values, accepting that this narrows the semi-trusted user population rather than eliminating the flaw; alternatively disable or gate the curator event-import and og:image fetching features, at the cost of removing legitimate import functionality. Enforce outbound egress filtering from the application host to block loopback, link-local (including 169.254.169.254), unique-local and RFC1918 destinations, with the trade-off that broad blocks may break legitimate imports from external services and must be scoped per deployment; note that Laravel's Http::get and file_get_contents in this code path are otherwise unrestricted, so network-level controls are the most reliable stopgap until the guard is rewritten and the validated IP is pinned.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Event Schedule is a PHP/Laravel event, ticketing and community application. Its sole URL-safety control for user-supplied import URLs is App\Utils\UrlUtils::isUrlSafe(), a CWE-918 class mitigation that tries to reject loopback, link-local, unique-local and other internal destinations before the URL is fetched by ImportCuratorEvents via Http::get($url), with the response body parsed and imported as events, plus a second-order fetch of the og:image through file_get_contents(). The primary bypass is a parsing/normalization defect: parse_url('http://[::1]:6379/')['host'] returns the host with its square brackets intact, so filter_var('[::1]', FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) returns false and the entire IPv6 block (::1, fe80::/10, fc00::/7, ::ffff:, 2001:db8::/32) is skipped; the direct string comparison against '::1' and the $blockedHosts list also miss, and gethostbyname('[::1]') returns the input unchanged so the resolved-IP comparison is skipped as well, and the function returns true. Unbracketed literals such as http://127.0.0.1/ are correctly rejected, which isolates the defect to bracket handling. The secondary bypass is a fail-open resolution design: the guard resolves names with gethostbyname(), which only returns A records and returns the hostname unchanged when no A record exists, and the code treats that unchanged value as a reason to skip the private-IP check; a hostname with only an AAAA record pointing at an internal address therefore passes validation and is re-resolved at fetch time. Because the validated address is never pinned to the actual request, DNS rebinding also works against dual-stack hosts that present a public A record during validation and an internal address during the fetch. Exploitation requires an authenticated account owning a curator role, which can supply import_urls through the role update flow (RoleController, authorize('update', $role)); no non-default server configuration is needed. The impact is confidential - internal-service responses surface back to the attacker as imported event data, so the SSRF is non-blind - with no integrity or availability effect modelled in the assessed vector.
Know when Eventschedule gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Remotely reachable and trivially triggered (AV:N/AC:L), but gated behind an authenticated curator role (PR:L); non-blind SSRF reads internal-service responses (C:H) with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and file_get_contents($ogImage)). At time of publication, there are no publicly available patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB