CVE-2026-41177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41177
Aliases
  • GHSA-45fq-w37p-qfw5
Published
2026-04-22T21:24:10.051Z
Modified
2026-08-12T03:51:26.979848999Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction
Details

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied Url parameter, allowing the use of the file:// protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.

Database specific 
{
    "cwe_ids": [
        "CWE-73",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41177.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/squidex/squidex

Affected ranges

Type
GIT
Repo
https://github.com/squidex/squidex
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b81d75e1d9c1a8e30993c2ee59b350002b9aeda4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.23.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

17.*
17.4.0
3.*
3.0.0
3.1.0
3.2.0
3.2.1
3.3.0
3.4.0
3.5.0
4.*
4.0.0
4.0.0-beta1
4.0.1
4.0.2
4.0.3
4.1.0
4.1.0-beta1
4.1.0-rc
4.1.1
4.1.2
4.2.0
4.2.0-beta1
4.2.0-beta2
4.3.0
4.4.0
4.4.0-rc
4.5.0
5.*
5.0.0
5.0.0-beta1
5.0.0-beta2
5.1.0
5.1.1
5.2.0
5.2.1
5.3.0
5.4.0
5.5.0
5.6.0
5.7.0
5.8.0
5.8.1
5.8.2
5.9.0
6.*
6.0.0
6.0.1
6.1.0
6.2.0
6.3.0
6.4.0
6.5.0
6.7.0
6.8.0
7.*
7.0.0
7.0.0-rc1
7.0.0-rc2
7.0.0-rc3
7.0.1
7.0.2
7.0.3
7.1.0
7.10.0
7.11.0
7.12.0
7.13.0
7.14.0
7.15.0
7.16.0
7.17.0
7.19.0
7.2.0
7.20.0
7.21.0
7.22.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.7.0
7.8.0
7.8.1
7.8.2
7.9.0
v1.*
v1.0
v1.0-beta1
v1.0-beta2
v1.0-beta3
v1.1
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41177.json"