EUVD-2026-53323
GHSA-q8pq-98hq-mg7f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Loopback bypass is AC:L; SSRF causing requests to reach systems beyond the app warrants S:C; blind probing yields minimal C:L with no direct read-back.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
1DescriptionCVE.org
Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back.
AnalysisAI
Blind SSRF in Firefly III's webhook subsystem exploits two distinct validation failures: an explicit early-return in IsValidWebhookUrl.php that whitelists the entire 127.0.0.0/8 loopback range, and a TOCTOU race where hostname resolution at validation time (gethostbyname()) is decoupled from the independent re-resolution performed by Guzzle at send time, enabling DNS rebinding to bypass private-range filters. Exploitation requires an authenticated user and the webhooks feature to be enabled, which is off by default. This is a blind SSRF primitive with no exploit code publicly identified at time of analysis - webhook responses are written only to a server-side debug log, restricting attacker utility to internal service probing and side-effect triggering rather than direct data exfiltration.
Technical ContextAI
Firefly III is a self-hosted PHP personal finance manager. The vulnerability spans two source files: IsValidWebhookUrl.php (the URL validator) and StandardWebhookSender.php (the Guzzle-backed delivery component). CWE-918 (Server-Side Request Forgery) applies through two mechanistically distinct pathways. The first is a filter bypass: the validator uses an early-return that explicitly permits any resolved address in 127.0.0.0/8, undermining the broader private-range filtering logic. The second is a TOCTOU variant of SSRF: gethostbyname() resolves the target hostname once at validation time, but Guzzle independently re-resolves the hostname when issuing the outbound HTTP request at send time - an attacker controlling a short-TTL DNS record can pass validation against a public IP, then flip the record to a private or loopback address before Guzzle fires. No CPE string was provided in the intelligence data; the affected component is the upstream repository at github.com/firefly-iii/firefly-iii.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified in the available data - the sole reference points to the upstream repository at https://github.com/firefly-iii/firefly-iii without a specific advisory or tagged release. Administrators should monitor that repository for commits touching IsValidWebhookUrl.php and StandardWebhookSender.php. As an immediate compensating control, disable the webhooks feature entirely if it is not operationally required; since webhooks are off by default, this restores the default-safe posture with no functional impact for non-webhook users. If webhooks must remain enabled, enforce network-level egress filtering on the Firefly III host to block outbound connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback (127.0.0.0/8) - this control must be applied at the host or firewall layer, not the application layer, since the application-level filter is the vulnerable component. To mitigate the DNS rebinding path specifically, configure the host to use a DNS resolver with rebinding protection (e.g., dnsmasq with --stop-dns-rebind, or a resolver that rejects private-IP responses for public domain names); note this adds resolver dependency and may cause failures for legitimate split-horizon DNS setups.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today