CVE-2026-49328

CVE-2026-49328: Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF

Vendor Apache Software Foundation
Product Apache Fesod (Incubating)
Weakness CWE-918 · SSRF
Published June 1, 2026
Last update June 1, 2026

CVSS base score

What the vulnerability does

Description

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

Key dates

Disclosure timeline

June 1, 2026 CVE published
June 1, 2026 Record updated