EUVD-2026-29701Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable ingest feature usable by a low-privileged authenticated uploader (PR:L, AC:L); SSRF reaches other systems (S:C) leaking their data (C:H) with no integrity or availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.
AnalysisAI
Server-Side Request Forgery in Xibo CMS versions prior to 4.4.1 lets an authenticated user with Library upload permissions coerce the CMS server into issuing arbitrary HTTP requests to internal or external hosts. This enables internal network scanning, reaching cloud instance-metadata endpoints such as AWS IMDS, pivoting to unauthenticated internal services, and data exfiltration. No public exploit identified at time of analysis; EPSS is low (0.03%, 9th percentile) and CISA SSVC records exploitation as none.
Technical ContextAI
Xibo is an open-source digital signage platform pairing a PHP-based web content management system with Windows player software; the affected component (cpe:2.3:a:xibosignage:xibo-cms) is the CMS server. The flaw is classified CWE-918 (Server-Side Request Forgery), a class where the application fetches a user-supplied URL without adequately validating or restricting the destination. Here the Library upload/media-ingest workflow accepts a remote resource location and the server dereferences it, so an attacker controls the request target from the trusted server-side network position - the canonical vector for hitting link-local metadata services (169.254.169.254) and RFC1918 hosts a remote attacker could not otherwise reach.
RemediationAI
Upgrade to Xibo CMS 4.4.1, which contains the fix (Vendor-released patch: 4.4.1), per the advisory at https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh. If immediate upgrade is not possible, reduce exposure by restricting Library upload permissions to the minimum set of trusted users (removing that permission blocks the vector but disables remote media ingestion for those accounts), and place the CMS behind egress network controls: block the server's outbound access to the cloud metadata address 169.254.169.254 and to internal RFC1918 ranges it does not legitimately need, and enforce IMDSv2 on AWS to blunt credential theft (trade-off: legitimate remote-URL media fetches to external CDNs may break and must be explicitly allowlisted). These are compensating controls only; the patch is the definitive fix.
SQL injection in Xibo CMS versions 1.7 through 4.4.0 allows authenticated users with DataSet or Layout access privileges
Stored cross-site scripting in Xibo CMS prior to 4.4.2 allows authenticated users with elevated DataSet privileges to ch
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity d
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today