CVE-2026-115411

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-115411

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115411.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-115411

Published

2026-10-22T13:20:01Z

Modified

2026-10-23T02:45:53Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

crawlseo before 0.2.4 Server-Side Request Forgery via Crawler

Details

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115411.json"
}

References

Affected packages

Git / github.com/crawlseo/crawlseo

Affected ranges

Type

GIT

Repo

https://github.com/crawlseo/crawlseo

Events

Introduced

f83a60ade5cf71be3806bc28e70b4638e54df20d

Fixed

c87c255e0291d78b15bc5496331d9b6b29098b23

Fixed

76e4e693de0c6b294cf1f60656800e47346f1c28

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.1.0"
                },
                {
                    "fixed":  "0.2.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "76e4e693de0c6b294cf1f60656800e47346f1c28"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115411.json"