CVE-2026-11437 MEDIUM

CVE-2026-11437: perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

Vendor Perfree
Product go-fastdfs-web
Weakness CWE-918 · SSRF
Published June 6, 2026
Last update June 8, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

June 6, 2026 CVE published
June 8, 2026 Record updated