Kavita EUVD-2026-99008

Requires a valid authenticated Kavita account with permission to use the CBL import feature (PR:L), and the ability to submit an attacker-controlled URL to the POST /api/Cbl/upload-cbl-file endpoint. The core precondition is winning a time-of-check/time-of-use race via DNS rebinding - the hostname must resolve to an allowed address during the FlurlConfiguration blocklist validation and then re-resolve to an internal address before the server fetches it - or alternatively the attacker's server must return an HTTPS redirect to an internal address that the client follows without re-validation (CVSS AT:P reflects this attack requirement). Exploitation is LIMITED by: mandatory authentication, the need for the Kavita server to have network reachability to interesting internal targets, the blind nature of the probing (Low confidentiality, no data return guaranteed), and the inherent reliability challenge of the rebinding race.

This is a low-priority, low-severity issue despite being a confirmed SSRF (CWE-918). The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N) and base score of 2.3 align well with the description: exploitation is network-reachable but requires an authenticated low-privileged account (PR:L) and a specific attack requirement (AT:P) - winning a DNS-rebinding race or a server-following HTTPS redirect after the blocklist validation passes. Vulnerable-system confidentiality is only Low (VC:L) with no integrity or availability impact (VI:N/VA:N), consistent with the description's 'blind internal port and service probing' rather than data exfiltration or RCE. No EPSS score, CISA KEV listing, or SSVC decision point was provided in the input; KEV status is not present, so this is NOT confirmed as actively exploited. A detailed technical writeup (hackmd) and a VulnCheck advisory exist, but no explicit proof-of-concept exploit code flag is provided in the input. Net assessment: a genuine but minor hardening/defense-in-depth issue in a self-hosted application - the authentication requirement, the timing/redirect precondition, and the blind, low-impact outcome all cap real-world risk well below what the SSRF label alone might suggest.

An attacker who already holds a valid low-privileged Kavita account submits a CBL-upload URL to POST /api/Cbl/upload-cbl-file pointing at a hostname they control that passes the SSRF blocklist check, then rebinds that hostname (or returns an HTTPS redirect) to an internal address such as 169.254.169.254 or 127.0.0.1:port before the server fetches it. By observing response timing or behavior differences, they perform blind enumeration of internal hosts, ports, and services reachable from the Kavita server. A public exploit flag is not present in the input, though a technical writeup describing the technique is referenced.