EUVD-2026-71951
GHSA-474j-x27j-w5wx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF (PR:N/UI:N/AV:N/AC:L) reaching internal metadata is a scope change (S:C) with high confidentiality disclosure; no integrity or availability impact described.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
AnalysisAI
Server-side request forgery in Webstudio through 0.296.0 lets unauthenticated remote attackers abuse the /cgi/image, /cgi/video, and /cgi/asset proxy routes to fetch attacker-chosen URLs whenever the RESIZE_ORIGIN environment variable is unset. Because the proxy blindly forwards supplied URLs, an attacker can read cloud instance metadata (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the RESIZE_ORIGIN environment variable to be unset on the Webstudio deployment - this specific fallback is what causes the /cgi/image, /cgi/video, and /cgi/asset routes to accept and proxy arbitrary attacker-supplied URLs; deployments that define RESIZE_ORIGIN are not vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score is 9.2 (Critical) with AV:N/AC:L/PR:N/UI:N and VC:H plus subsequent-system SC:H, reflecting unauthenticated network exploitation that pivots into internal infrastructure - consistent with the SSRF metadata-theft pattern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released fixed version is identified in the available data (the references point to the repository, the affected route source files at commit 55920c5, and the tracking issue #5816, not to a tagged patched release), so treat this as: no vendor-released patch identified at time of analysis - monitor issue #5816 and the VulnCheck advisory for a fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Webstudio deployments and verify RESIZE_ORIGIN environment variable configuration status; immediately restrict external access to instances without this variable set. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today