EUVD-2026-59840
GHSA-vv7q-2wgr-7w2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OpenBoxes with low-privilege account
-
DeliveryCraft POST request to Product Upload endpoint
-
ExploitSupply internal/metadata URL as params.url
-
ExecutionServer fetches attacker-specified URL unconditionally
-
ImpactExfiltrate response data (credentials, internal service data)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated OpenBoxes session with at least low-privilege access (CVSS PR:L confirmed by 4.0 vector) - unauthenticated attackers cannot reach the endpoint. The vulnerability triggers specifically when the |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) characterizes this as a medium-severity (5.3), network-exploitable flaw with low attack complexity, requiring low-privilege authentication, with limited confidentiality, integrity, and availability impact scoped to the vulnerable system only. The E:P tag confirms proof-of-concept exploit code is publicly available, elevating practical exploitability beyond the base score alone. EPSS score was not provided in the input data. No CISA KEV listing means active exploitation is not confirmed. The real-world risk is environment-dependent: OpenBoxes instances deployed in cloud environments (AWS, GCP, Azure) face materially higher risk because a successful SSRF can reach instance metadata services (169.254.169.254) and potentially retrieve IAM credentials. On-premises deployments with no sensitive internal HTTP services face reduced but non-zero risk. The PR:L requirement (authenticated user) meaningfully limits the exposed attack surface compared to unauthenticated SSRF - this is a medium-priority issue for most organizations, elevated to high priority for cloud-hosted deployments. |
| Exploit ScenarioDerived | An authenticated OpenBoxes user (any low-privilege role with access to the product management interface) submits a crafted POST request to the Product Upload endpoint, setting |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 16, 2026
Server-side request forgery in OpenBoxes up to v0.9.7 allows authenticated remote attackers to coerce the application server into issuing HTTP requests to arbitrary internal or external URLs via the unvalidated params.url parameter in the Product Upload endpoint. The vulnerable code in ProductController.groovy passes the attacker-supplied URL directly to new URL(params.url).openStream() with no allowlist, blocklist, or scheme restriction - a textbook CWE-918 implementation flaw. A public proof-of-concept exploit exists on GitHub Gist, and the fix (removing the URL-based upload code path entirely) is available in v0.9.8 and v0.9.8-hotfix1; no CISA KEV listing at time of analysis.
RemediationAI
Upgrade to OpenBoxes v0.9.8 or v0.9.8-hotfix1, available at https://github.com/openboxes/openboxes/releases/tag/v0.9.8; this is confirmed by the vendor patch (commit a599007325efe780a21b3537ecce3ca25635c926) and the GitHub release tag. The fix completely removes the URL-based document upload code path, eliminating the attack surface rather than attempting input sanitization. If an immediate upgrade is not feasible, apply the following compensating controls: (1) configure outbound firewall rules on the OpenBoxes application server to block HTTP/HTTPS connections to RFC-1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata IPs (169.254.169.254) - this reduces SSRF impact but does not prevent external SSRF; (2) restrict access to the Product Upload endpoint at the WAF or reverse-proxy layer to the minimum set of authorized user roles - this reduces the attack surface by limiting which authenticated users can reach the vulnerable endpoint. Neither compensating control fully eliminates the vulnerability; upgrade remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenBoxes is a Grails-based (Java/Groovy) open-source supply chain management application used primarily in humanitarian health contexts. The root cause (CWE-918) is direct, unsanitized use of attacker-controlled input in a server-side URL fetch: the upload() action in ProductController.groovy checked if (params.url) and then executed out << new URL(params.url).openStream(), writing the fetched response to a local file without validating the scheme, host, or IP range. This allows redirection to internal services (e.g., cloud metadata endpoints at 169.254.169.254, internal APIs, loopback services) or arbitrary external hosts. The affected CPE is cpe:2.3:a:n/a:openboxes:*:*:*:*:*:*:*:* covering all versions through 0.9.7. The patch (commit a599007325efe780a21b3537ecce3ca25635c926, PR #5944) eliminates the vulnerability by completely removing the 108-line URL-fetch code block rather than attempting input validation, which is the more robust remediation strategy.
Know when Openboxes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint requires low-privilege authentication (PR:L); SSRF enables internal data access (C:L) and local file write from fetched content (I:L); no meaningful availability impact from URL-fetch pattern.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB