Sitefinity Next.js SDK CVE-2026-92931

Exploitation requires an application using the @progress/sitefinity-nextjs-sdk npm package at versions 15.1.8326 through 15.4.8637 that exposes the vulnerable server-side request path to attacker-influenced input. The CVSS UI:R flag indicates exploitation is not fully autonomous - a user or server-side workflow must be induced to process the attacker-supplied request/URL, which limits drive-by mass exploitation. No authentication is required (PR:N), so any remote party able to reach the affected endpoint and satisfy the interaction requirement can attempt the SSRF; impact is bounded to what internal/external hosts the server can reach and what sensitive data those responses expose. The specific vulnerable feature (proxy, image handler, or fetch route) is not named in the input and should be confirmed in the Progress advisory to scope affected deployments.

The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated SSRF that nonetheless requires user interaction (UI:R) - meaning a victim or automated server-side flow must be induced to process attacker-supplied input. There is no public exploit identified at time of analysis: the input contains no EPSS score, no CISA KEV listing, and no POC reference, so real-world exploitation signals are currently absent despite the high CVSS. The full C:H/I:H/A:H impact rating appears vendor-conservative for a CWE-918 SSRF whose described outcome is 'potentially exposing sensitive information' - the description substantiates a strong confidentiality impact but does not describe integrity or availability loss, so the I:H and A:H ratings are not corroborated by the text and should be verified against the Progress advisory. Net assessment: a genuinely serious SSRF in a specific enterprise SDK, but with no evidence of active or automated exploitation yet; prioritize patching where the SDK is deployed, while treating the breadth of impact as partly unconfirmed.

A remote attacker crafts a malicious request or URL that a Sitefinity Next.js SDK endpoint (e.g., a server-side fetch/proxy routine) processes, causing the backend to issue a request to an attacker-controlled host (UI:R implies a victim-triggered or server-processed input path). The attacker uses the forced server-side request to reach internal services or cloud metadata endpoints and exfiltrate sensitive information returned to or inferred by them. No public exploit code is identified at time of analysis, so this scenario is inferred from the CWE-918 classification and CVSS vector rather than a demonstrated POC.