EUVD-2026-26074Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery (SSRF) in o2oa up to version 10.0 allows authenticated remote attackers to manipulate the fileUrl parameter in the FileAction component to trigger arbitrary HTTP requests from the server. The vulnerability requires authenticated access (PR:L) but can facilitate attacks against internal services, exfiltrate sensitive data, or pivot to backend systems. Publicly available exploit code exists, and the vendor has not yet responded to early notification.
Technical ContextAI
o2oa is a Java-based workflow and office automation platform. The vulnerability exists in the FileAction.java component's URL Fetching functionality, which accepts user-supplied input via the fileUrl parameter without proper validation. This is a classic CWE-918 Server-Side Request Forgery flaw where the application constructs HTTP requests based on attacker-controlled input, allowing the attacker to coerce the server into making requests to arbitrary URLs. The underlying weakness is insufficient input sanitization on the fileUrl parameter before passing it to HTTP client libraries.
RemediationAI
No vendor-released patch has been identified at time of analysis. Given the lack of vendor response documented in the CVE, organizations should implement compensating controls immediately. Primary recommendation: Restrict network access to the FileAction endpoint by implementing firewall rules or application-level access controls to limit exposure to authenticated users only - this mitigates the risk of opportunistic exploitation but does not eliminate the threat from compromised credentials. Secondary control: Implement egress filtering at the network boundary to prevent the o2oa server from reaching internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and metadata services (169.254.169.254/32 for AWS/GCP); this prevents server-side pivots but may break legitimate integrations - test thoroughly before production deployment. Tertiary control: Run o2oa with minimal network privileges and segment it from sensitive internal systems via network policies. Monitor for suspicious outbound requests from o2oa servers. Escalate requests to the o2oa project maintainers (https://github.com/o2oa/o2oa/) for patch status and timeline. Consider evaluating alternative workflow automation platforms if patch is not released within your organization's acceptable timeframe.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today