Which versions of go-fastdfs-web are affected by EUVD-2026-34972?

perfree go-fastdfs-web versions through 1.3.7 contain an unauthenticated server-side request forgery vulnerability in the installation endpoint that allows attackers to probe internal networks and…

Is there a public PoC exploit available for EUVD-2026-34972?

Yes, a public proof-of-concept exploit is available for EUVD-2026-34972. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-34972?

WITHIN 24 HOURS: Inventory go-fastdfs-web deployments (specifically versions 1.3.7 and earlier); restrict network access to the /install/checkServer endpoint via firewall; deploy Web Application Firewall rules to block SSRF payloads targeting internal networks. WITHIN 7 DAYS: Contact vendor to confirm patch availability status; evaluate migration to alternative file storage solutions with documented patch support. WITHIN 30 DAYS: Execute migration to patched alternative software or implement network isolation with egress controls blocking connections to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata services (169.254.169.254), with continuous egress monitoring.

go-fastdfs-web EUVD-2026-34972

Q: What is the CVSS score of EUVD-2026-34972?

EUVD-2026-34972 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-11437 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-06 VulDB

GHSA-6g49-gvr8-2cj2

SSRF Go Fastdfs Web Perfree

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 06, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 06, 2026 - 17:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 06, 2026 - 17:15 vuln.today

DescriptionCVE.org

A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in perfree go-fastdfs-web versions up to 1.3.7 allows remote unauthenticated attackers to coerce the application into issuing arbitrary outbound HTTP requests via the checkServer function exposed at the /install/checkServer installation endpoint. Publicly available exploit code exists per VulDB, and the vendor did not respond to disclosure, leaving deployments without a confirmed fix. The flaw is reachable network-wide with no authentication and low complexity, raising the practical risk of internal network reconnaissance and cloud metadata abuse.

Technical ContextAI

go-fastdfs-web is a Go-based web management frontend for the FastDFS distributed file system maintained by the perfree project. The vulnerability is classified as CWE-918 (Server-Side Request Forgery), a class of bug where a server accepts a user-controlled URL or host parameter and issues an outbound request without validating the destination. Here the unsafe sink is checkServer, a routine reachable through the /install/checkServer installation endpoint - typically used during initial setup to probe a backend FastDFS node, meaning the URL/host input is passed to an HTTP client that the attacker can redirect to internal hosts, loopback interfaces, or cloud instance metadata endpoints such as 169.254.169.254.

RemediationAI

No vendor-released patch identified at time of analysis, since perfree did not respond to the VulDB disclosure for go-fastdfs-web through 1.3.7. Defenders should monitor the project repository for releases beyond 1.3.7 and apply any future fix promptly; in the interim, restrict network access to the /install/checkServer endpoint via reverse-proxy or firewall rules (the installation endpoint should not be reachable after initial setup, so blocking it outright is a low-impact mitigation), bind the service to localhost or an admin VLAN, and place egress filtering on the host so outbound HTTP from the application can only reach the intended FastDFS backend - this prevents SSRF pivots to RFC1918 ranges, 127.0.0.1, and cloud metadata addresses such as 169.254.169.254, at the cost of breaking any legitimate cross-segment backend probing. For tracking, reference the VulDB advisory at https://vuldb.com/vuln/369017 and the PoC writeup linked from the same record.