ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
[
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.20170111.1"
}
]
},
{
"events": [
{
"introduced": "3.20190207"
},
{
"fixed": "3.20190226"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.20180105"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.20180228"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.20180311"
}
]
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9187.json"