EUVD-2026-54397
GHSA-jxrw-hc36-36pw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-reachable SSRF requiring user interaction to trigger; limited read/write impact to internal services, no availability loss, scope unchanged.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery.
This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0.
AnalysisAI
Server-Side Request Forgery (SSRF) in Revenue Administration Türkiye's E-Signature (versions 2.4.4.0 through before 2.5.1.0) enables network-accessible attackers to coerce the application server into making arbitrary outbound HTTP requests by inducing a user to interact with crafted content. The partial confidentiality and integrity impact (C:L/I:L per CVSS) indicates an attacker could reach internal services or read limited internal responses, but cannot fully compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch to version 2.5.1.0 is available per TR-CERT advisory.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes a class of flaws where an application fetches a remote resource based on a user-controlled URL or parameter without adequate validation or allowlisting of destination targets. In Türkiye's E-Signature - a digital signature platform operated under Revenue Administration Turkey - the server can be directed to issue HTTP requests to attacker-specified endpoints, potentially reaching internal infrastructure not otherwise exposed to the internet. The CPE cpe:2.3:a:revenue_administration:türkiye's_e-signature:*:*:*:*:*:*:*:* confirms this affects the application tier of the e-signature service. SSRF vulnerabilities in e-signature and government identity platforms are particularly sensitive due to their access to internal PKI infrastructure and potentially privileged back-end services.
RemediationAI
Upgrade Türkiye's E-Signature to version 2.5.1.0 or later, which resolves this SSRF vulnerability per the vendor patch confirmed by TR-CERT. The advisory is published at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0772. If immediate patching is not possible, a compensating control would be to implement strict egress filtering on the application server, blocking outbound HTTP/HTTPS requests to internal RFC1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local ranges (169.254.0.0/16), as well as the loopback interface. This limits SSRF pivot potential to internal infrastructure, though it does not eliminate the flaw and may affect legitimate outbound functionality of the e-signature service - verify any blocklist against known-required outbound destinations before deploying.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today