Veille CVE

‹ Retour à la liste

CVE-2026-55160

7.6 Élevée

Publiée le 28/09/2026 à 20:17 · Modifiée le 30/09/2026 à 21:57 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS IMDS 169.254.169.254). When self-service signup is enabled (Setting::UserSignup), even a low-privileged registered user can exploit this to scan internal services or steal cloud IAM credentials. This issue has been patched via commit 75cb095.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 7.6 Élevée security-advisories@github.com CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Faiblesses (CWE)

Références

Ailleurs