EUVD-2026-51164
GHSA-rj28-q96f-28vw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated feature (AV:N/PR:L); scope change (S:C) as the app is abused to reach internal systems, yielding high confidentiality (metadata/creds) and low integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php incorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.
AnalysisAI
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated Kanboard user (CVSS PR:L) with access to a feature that fetches a user-controlled URL server-side - specifically the web link creation feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N, base 8.4 High) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring low-privilege authentication (PR:L) - matching the 'authenticated users' language. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege Kanboard account creates or edits a web link (or any feature that fetches a user-supplied URL) and points it at a hexadecimal-encoded internal address such as http://0xa9fea9fe/latest/meta-data/ to reach the cloud metadata service. Kanboard's isPrivateURL() filter fails to flag the hex address as private, so the server's cURL client fetches the internal resource and can leak instance-metadata credentials or probe localhost/RFC1918 services. … |
| Remediation | Upgrade to a Kanboard release later than 1.2.52 that fixes the hexadecimal-IP bypass; however, no vendor-released patched version was identified at time of analysis, so verify the exact fixed tag against the Kanboard repository (https://github.com/kanboard/kanboard) and the VulnCheck advisory (https://www.vulncheck.com/advisories/kanboard-and-prior-ssrf-filter-bypass-via-hexadecimal-ip-notation) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kanboard instances running version 1.2.52 or earlier and implement network segmentation to restrict outbound connections from Kanboard servers to only required external services, blocking access to internal IP ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today