Squidex EUVD-2026-25104

Attacker must possess authenticated access to the Squidex instance with schema editing permissions (PR:L). The vulnerability is exploitable when the scripting engine feature is enabled and users can define custom scripts that invoke HTTP client functions (getJSON, request). Squidex must have network access to the target internal endpoints or cloud metadata services the attacker wishes to reach. The vulnerability does NOT require non-default configurations - standard Squidex deployments with scripting functionality enabled are affected. Limiting factors: authentication barrier prevents fully unauthenticated remote exploitation, and schema editing permissions may be restricted in tightly controlled deployments. Cloud deployments using IMDSv2 (requiring session tokens) provide partial mitigation against metadata endpoint exploitation but do not eliminate SSRF risk to other internal services.

CVSS 4.0 score of 7.3 reflects high confidentiality and integrity impact to the vulnerable system (VC:H/VI:H) with network attack vector and low complexity (AV:N/AC:L/AT:N). The PR:L requirement means attackers need authenticated access with schema editing permissions, which represents a low barrier in many CMS deployments where content editors are common. The E:P modifier confirms publicly available exploit code exists. Real-world risk is elevated for cloud-hosted Squidex instances where IMDS access can expose IAM credentials, API keys, and temporary tokens, enabling privilege escalation beyond the CMS itself. Internal network deployments face risk of accessing administrative interfaces, configuration services, or databases on RFC1918 addresses. EPSS data not provided, but SSRF vulnerabilities historically show moderate exploitation rates when authentication is required. The combination of cloud metadata exposure potential, authenticated but low-privilege access requirement, and confirmed exploit code availability makes this a realistic threat for multi-tenant SaaS deployments or instances with broad user access. Priority should be HIGH for cloud-deployed instances with IAM role assignments, MEDIUM for isolated on-premises deployments where blast radius is contained to internal network enumeration.

An authenticated attacker with schema editing permissions creates a custom content schema in Squidex and adds a scripting rule that calls getJSON('http://169.254.169.254/latest/meta-data/iam/security-credentials/') to retrieve AWS IAM role credentials from the instance metadata service. The Squidex server executes this script during content processing, making the SSRF request and returning temporary AWS credentials to the attacker. The attacker then uses these credentials to access S3 buckets, modify EC2 instances, or escalate privileges within the AWS account, achieving lateral movement beyond the CMS application.