Eventschedule
Monthly
Server-side request forgery in the open-source Event Schedule platform (versions 1.0.0 and earlier) lets an authenticated user who holds a curator role store a crafted import URL that defeats the App\Utils\UrlUtils::isUrlSafe() guard, so the application later fetches internal or localhost services via ImportCuratorEvents and imports the response body as event data. Two bypasses are documented: bracketed IPv6 literals that parse_url leaves un-normalized, and an A-record-only resolver that fails open for AAAA-only or rebindable hostnames. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is limited by the curator-role requirement; no vendor-released patch was identified at time of analysis, and a public PoC reference (ported guard logic with sample outputs) accompanies the advisory.
Server-side request forgery in the open-source Event Schedule platform (versions 1.0.0 and earlier) lets an authenticated user who holds a curator role store a crafted import URL that defeats the App\Utils\UrlUtils::isUrlSafe() guard, so the application later fetches internal or localhost services via ImportCuratorEvents and imports the response body as event data. Two bypasses are documented: bracketed IPv6 literals that parse_url leaves un-normalized, and an A-record-only resolver that fails open for AAAA-only or rebindable hostnames. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is limited by the curator-role requirement; no vendor-released patch was identified at time of analysis, and a public PoC reference (ported guard logic with sample outputs) accompanies the advisory.