NiubiGEO EUVD-2026-109383

No authentication or user interaction is required (PR:N/UI:N confirmed): a remote attacker only needs network reachability to the NiubiGEO HTTP server's POST /audit-plan endpoint in any version before 0.3.2. The specific trigger is supplying a crafted 'domain' value - an IP literal, 'localhost', or a private/link-local host - which the site-evidence code (src/keywords/site-evidence.ts) fetches without validating that the target is a public address; the fetched response is then reflected back in the plan's siteEvidence JSON, making this a full-response ('read') SSRF. Limiting factors: the /audit-plan service must be network-reachable to the attacker, the vulnerable audit/site-evidence feature must be invoked, and the instance must be running a pre-0.3.2 build; cloud-metadata impact further depends on the server being hosted where a metadata endpoint (e.g., 169.254.169.254) is reachable. The 0.3.2 fix adds validatePublicWebUrl, which rejects localhost/.local/.internal and non-public IP ranges and re-validates each redirect hop.

This is a genuine but moderate-priority issue rather than a critical emergency. The signals are mostly consistent: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, low-complexity, unauthenticated trigger, which is why SSRF here is attractive - no credentials or user interaction are needed. However, the impact metrics are deliberately low (VC:L/VI:L/VA:N, score 6.9 Medium), reflecting that the flaw reads internal responses rather than directly granting code execution. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the Medium severity. No EPSS probability was provided, the CVE is NOT on CISA KEV, and no reference is labeled as a confirmed working exploit, so there is currently no evidence of active exploitation - the real-world danger depends heavily on where NiubiGEO is deployed. The most significant unstated risk is cloud metadata exposure: the description explicitly says an attacker can reach cloud metadata endpoints, and in IMDSv1 environments that can escalate a 'low confidentiality' SSRF into credential theft, so the CVSS impact score may understate consequences in cloud-hosted instances. Overall: a real, easily-triggered unauthenticated SSRF worth patching this month, but not a mass-exploitation emergency given the obscure product footprint and absence of exploitation/EPSS/KEV signals.

An unauthenticated attacker sends a POST request to /audit-plan with the 'domain' field set to an internal target such as 169.254.169.254, 127.0.0.1, or a private host. The NiubiGEO server fetches that address while building site evidence and returns the fetched response inside the plan's siteEvidence JSON, letting the attacker read loopback, internal-network, or cloud metadata content. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N); no confirmed working exploit code is identified, though a GitHub issue (#242) references the flaw.