wallabag CVE-2026-82081

The attacker must hold a valid wallabag account with at least low-privilege access (PR:L per CVSS vector) - anonymous exploitation is not possible against default configurations. The PDF export feature must be available and accessible to the attacker's account level; if export is restricted to administrators, the attack surface is confined to administrator accounts. Exploitation is triggered by the attacker deliberately invoking PDF export on their crafted article - no separate victim interaction is required (UI:N). The SSRF payload must be embedded in either the article title or content field. Exploitation is limited to environments where the wallabag server has outbound network access to the targeted internal resources; a strictly egress-filtered deployment substantially reduces impact even if the SSRF fires.

The NVD-assigned CVSS 3.1 score of 6.4 (Medium) is consistent with an authenticated SSRF with scope change but limited per-impact confidentiality and integrity ratings (C:L/I:L). However, the real-world risk may exceed a naive medium-severity read: the scope-changed vector means a successful exploit can pivot to internal services such as AWS/GCP/Azure instance metadata endpoints, internal APIs, or adjacent microservices, any of which could yield credentials or enable lateral movement. A separate full-disclosure repository references this same GHSA identifier with a CVSS of 8.5 and claims an additional Stored XSS vector - if confirmed, this would significantly elevate risk, as stored XSS in a web app often enables account takeover. EPSS data was not provided, and the vulnerability is not listed in the CISA KEV catalog, limiting confidence in exploitation probability. The authentication requirement (PR:L) reduces opportunistic exploitation but does not meaningfully protect instances with open registration. The primary limiting factor is that an attacker must have at least a low-privilege account and must trigger the PDF export action.

An attacker with a low-privilege wallabag account creates or imports an article with a crafted title or body containing a reference to an internal resource - such as the AWS instance metadata endpoint at http://169.254.169.254/latest/meta-data/ - then triggers the PDF export feature. The wallabag server-side PDF renderer fetches the crafted URL, and its response (potentially including cloud credentials or internal service data) may be observable in the exported PDF or inferred through timing differences. No public exploit code has been confirmed from the available data, though a full-disclosure post exists that may detail the technique.