Chaskiq EUVD-2026-102954

Requires that the Chaskiq GraphQL endpoint (POST /graphql) be network-reachable by the attacker and that the createUrlUpload mutation be invokable without authentication, which the CVSS PR:N and description confirm is the default. Impact is maximized when the instance runs on cloud infrastructure exposing an unprotected instance-metadata service (e.g. AWS IMDSv1 at 169.254.169.254) or other internal HTTP services the server can reach. Limiting factors: the severity of outcome depends on what internal/metadata endpoints are actually reachable from the host and whether hardening such as IMDSv2, egress filtering, or network segmentation is in place; these reduce but do not eliminate the SSRF itself.

All available signals point to a genuine, high-priority issue rather than a CVSS-inflated paper risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the impact metrics (VC:H, SC:H) correctly capture an SSRF that reads confidential data from the vulnerable system and from a subsequent system (e.g. a cloud metadata service). The description aligns cleanly with the vector - unauthenticated POST /graphql is consistent with PR:N, and arbitrary URL fetching with blob retrieval supports VC:H/SC:H - so there is no network-vs-local conflict to flag. EPSS is not provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no exploit-code flag is supplied, so this is 'no public exploit identified at time of analysis'; however, a detailed public technical write-up (hackmd) and the exact vulnerable source file are referenced, which materially lowers the effort to develop a working exploit even though that does not equate to confirmed active exploitation. Net assessment: real priority for anyone running Chaskiq, especially on cloud infrastructure with reachable instance-metadata endpoints, tempered by the product's limited deployment footprint.

An unauthenticated attacker sends a crafted createUrlUpload GraphQL mutation to the public POST /graphql endpoint pointing at an internal URL such as a cloud instance-metadata endpoint (e.g. 169.254.169.254). The server fetches that URL server-side and exposes the full response through the returned ActiveStorage blob URL, letting the attacker read internal services or steal cloud credentials. No public exploit code is confirmed, but a step-by-step technical write-up and the vulnerable source are publicly referenced, and the low-complexity network vector makes exploitation straightforward.