EUVD-2026-92798
GHSA-94mc-96pm-mv7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged O2OA user
-
DeliveryCraft request to excel upload/with/url endpoint
-
ExploitManipulate fileUrl to internal target
-
ExecutionServer issues forged request
-
ImpactRetrieve internal resource response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the target O2OA instance (CVSS PR:L) and access to the General Module's ActionUploadExcelWithUrl handler at /x_general_assemble_control/jaxrs/excel/upload/with/url. The specific prerequisite is the ability to supply the fileUrl argument to that Excel-upload-from-URL endpoint, which the server then fetches without adequate validation. Limiting factors: valid authentication is mandatory (not remote-unauthenticated), impact is confined to low confidentiality exposure (VC:L) with no integrity or availability effect, and the product affected is O2OA versions up to and including 10.0.1-ce. No user interaction is required. |
| Impact | This is a low-priority, low-real-risk issue despite being remotely reachable. The input provides only a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scoring 2.1, which reflects network attack vector and low complexity but limited confidentiality impact (VC:L) and no integrity or availability impact. Critically, PR:L means exploitation requires an authenticated low-privileged account, substantially narrowing the attacker population. The vector carries E:P (Proof-of-Concept), consistent with the description's statement that 'the exploit has been published,' so publicly available exploit code exists - but this is NOT active exploitation. There is no CISA KEV listing and no EPSS score provided in the input, so widespread opportunistic exploitation cannot be confirmed; absence of these signals plus a very low base score suggests this is not a priority for most defenders. CWE-918 (SSRF) is confirmed by both the description and the SSRF tag. Note the vendor has not responded to the issue report, meaning no official patch is confirmed available. |
| Exploit ScenarioDerived | An authenticated low-privileged user of an O2OA deployment submits a crafted request to the /x_general_assemble_control/jaxrs/excel/upload/with/url endpoint, manipulating the fileUrl parameter so the server fetches an attacker-chosen URL. This lets the attacker coerce the server into making requests to internal-only hosts or metadata services. Published exploit code exists, lowering the barrier to reproduction, though valid authentication is required first. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Server-side request forgery in O2OA up to and including 10.0.1-ce lets an authenticated, low-privileged user force the application server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted fileUrl argument to the ActionUploadExcelWithUrl handler in the General Module. Publicly available exploit code exists and the flaw is remotely reachable, but impact is limited to low confidentiality exposure (CVSS 3.1 base of 2.1, PR:L, C:L with no integrity or availability effect), so this is a low-priority issue despite the SSRF classification. The vendor was notified through a GitHub issue report and has not responded, so no patched release is identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis: the project was informed via GitHub issue 210 and had not responded, and no fixed version is documented, so do not assume an upgrade target exists - track https://github.com/o2oa/o2oa/issues/210 and the VULDB advisory https://vuldb.com/vuln/413603 for a vendor fix and apply it as soon as a fixed release supersedes 10.0.1-ce. Until then, apply compensating controls rather than relying on generic hardening. First, restrict the endpoint /x_general_assemble_control/jaxrs/excel/upload/with/url at the reverse proxy or application firewall so that only trusted administrative roles can reach it, or block it entirely if the Excel-import-from-URL feature is not actually used - the trade-off is that legitimate users lose remote spreadsheet importing. Second, enforce strict outbound egress filtering on the O2OA host, allowing only the specific hosts and ports genuinely required for imports and denying loopback, link-local (169.254.0.0/16, including cloud metadata at 169.254.169.254), and RFC1918 ranges at the network layer; this can break integrations that legitimately pull documents from internal file servers. Third, if code changes are possible, add allowlist validation of the fileUrl scheme and resolved destination host plus post-DNS-resolution IP checks (defeating DNS rebinding) and disable automatic redirect following in the HTTP client - redirect handling is frequently the bypass for naive allowlists. Finally, since exploitation requires an authenticated low-privileged account, reduce the number of accounts with General Module access and audit logs for outbound requests originating from the Excel-upload handler.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is O2OA's 'x_general_assemble_control' general-assembly web module, a Java/JAX-RS-based service that exposes the endpoint /x_general_assemble_control/jaxrs/excel/upload/with/url. That endpoint implements the Excel-import-from-URL feature: it accepts a fileUrl parameter and instructs the server to fetch the referenced remote document so its contents can be parsed into a spreadsheet/import model. Because the argument is used to build the outbound request without adequate validation of scheme, host, or resolved IP address, an attacker controls the destination of a server-side HTTP request - the classic CWE-918 server-side request forgery root cause. This class of flaw typically abuses trusted network position rather than application logic: the server will happily reach internal-only services, loopback interfaces, or cloud instance metadata endpoints (e.g. 169.254.169.254) that the attacker cannot reach directly. In this instance the independent assessment scores the consequence as low, since the endpoint returns fetched content with limited disclosure value and there is no demonstrated write or denial-of-service effect; the CVSS 4.0 vector records E:P, meaning exploit code availability was factored in, and the attack requires a valid low-privileged session (PR:L) rather than being unauthenticated.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remotely reachable endpoint (AV:N, AC:L) but requires an authenticated low-privileged account (PR:L); SSRF yields limited internal data exposure (C:L) with no integrity or availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB