Wheels Framework EUVD-2026-102603

Exploitation requires a specific, non-default alignment of conditions all stated in the advisory: (1) no explicit error-email recipient is configured in the Wheels app, so the default is derived from the request Host header; (2) a mail server IS configured so error emails actually send; (3) the fronting web server/proxy accepts an attacker-chosen Host value rather than enforcing an allowlist; and (4) the attacker's request must trigger or coincide with an application cold start, because the derived address is fixed for that application's lifetime. Limiting factors that reduce real-world risk: the cold-start timing race (one window per app lifecycle), the requirement that Host validation is absent upstream, and engine dependence - on the Lucee 7 engine scope dumps fail to render, restricting disclosure to header fields rather than configuration secrets and session/cookie data.

This is a moderate, conditional-risk information-disclosure flaw (CWE-348, Reliance on Reverse DNS / untrusted source - here the Host header) rather than a top-tier priority. The CVSS 5.9 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly captures the tension: it is network-reachable and unauthenticated (PR:N), which sounds alarming, but AC:H reflects the substantial chain of preconditions and the race condition required, and impact is confidentiality-only (I:N/A:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so by the precision rules this is 'no public exploit identified at time of analysis' - all three exploitation signals are absent or neutral, which argues against widespread opportunistic attack. The high confidentiality rating (C:H) is engine-dependent and should be read with caution: the description states that on Lucee 7 scope dumps fail to render, limiting disclosure to header fields only, whereas on other engines/versions scope dumps may leak configuration secrets and other users' session/cookie data - so real-world severity varies by deployment and C:H represents the worst-case engine. The attack also hinges on winning a one-time cold-start window and on a non-default condition (no explicit error-email recipient configured plus a working mail server), which further narrows realistic exploitability. Net: a legitimate issue worth patching, but closer to a targeted/opportunistic misconfiguration-dependent leak than a broadly weaponizable critical bug.

An attacker repeatedly sends requests with an attacker-controlled Host header to a Wheels application whose web/proxy layer accepts arbitrary Host values, timing a request to coincide with an application cold start (e.g., after a deploy or idle recycle). Because the app has a mail server configured but no explicit error-email recipient, the derived error-email address is set from the attacker's Host, so all subsequent error emails for that app lifetime are delivered to a domain the attacker controls, leaking error and request metadata and - on vulnerable engines - configuration secrets and other users' session/cookie data. No public exploit code was identified at the time of analysis; AC:H reflects the cold-start timing and configuration preconditions required.