EUVD-2026-51164
GHSA-rj28-q96f-28vw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated feature (AV:N/PR:L); scope change (S:C) as the app is abused to reach internal systems, yielding high confidentiality (metadata/creds) and low integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php incorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.
AnalysisAI
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. Publicly available exploit code exists (a proof-of-concept gist), though there is no public exploit identified as being used in active attacks; EPSS was not provided.
Technical ContextAI
Kanboard is an open-source PHP project-management/kanban application. The affected component is its HTTP client (app/Core/Http/Client.php), used by features such as web link creation that fetch user-supplied URLs server-side. The root cause is a classic CWE-918 (SSRF) validation gap: the SSRF guard calls PHP's FILTER_VALIDATE_IP to decide whether a host is a private/internal address, but that function only recognizes canonical dotted-decimal (and colon-hex IPv6) formats. When an attacker supplies an IPv4 address in hexadecimal integer form (e.g. 0x7f000001 for 127.0.0.1), FILTER_VALIDATE_IP returns false, so isPrivateURL() concludes the destination is not private and permits the request - but the underlying cURL/libcurl resolver still interprets and dials the hex address. This parser-differential between the validator and the actual network stack is what enables the bypass. Affected package per CPE: cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade to a Kanboard release later than 1.2.52 that fixes the hexadecimal-IP bypass; however, no vendor-released patched version was identified at time of analysis, so verify the exact fixed tag against the Kanboard repository (https://github.com/kanboard/kanboard) and the VulnCheck advisory (https://www.vulncheck.com/advisories/kanboard-and-prior-ssrf-filter-bypass-via-hexadecimal-ip-notation) before deploying. Until a confirmed patch is applied, compensating controls include: harden isPrivateURL() to canonicalize hosts before validation (resolve/normalize hex, octal, decimal-integer, and IPv6-mapped forms to dotted-decimal, then re-check against private ranges) rather than trusting FILTER_VALIDATE_IP alone; run Kanboard behind an egress proxy or firewall that blocks outbound access from the app server to 169.254.169.254 (cloud metadata), 127.0.0.0/8, and RFC1918 ranges - with the side effect of breaking any legitimate internal link-fetching; enforce IMDSv2 (session-token-required metadata) on cloud instances to blunt credential theft via SSRF; and restrict who can authenticate by disabling open registration and limiting accounts to trusted users, at the cost of reduced convenience for self-service teams.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today