{"id":"CVE-2026-55160","published":"2026-09-28T18:17:23.540","lastModified":"2026-09-28T19:16:49.873","description":"Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS IMDS 169.254.169.254). When self-service signup is enabled (Setting::UserSignup), even a low-privileged registered user can exploit this to scan internal services or steal cloud IAM credentials. This issue has been patched via commit 75cb095.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/stringer-rss/stringer/commit/75cb0955919a362ac49d23c8a14892d0f59ea1c4","tags":[]},{"url":"https://github.com/stringer-rss/stringer/pull/1548","tags":[]},{"url":"https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q","tags":[]},{"url":"https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q","tags":[]}],"exploitRefs":[{"url":"https://github.com/stringer-rss/stringer/commit/75cb0955919a362ac49d23c8a14892d0f59ea1c4","tags":[]},{"url":"https://github.com/stringer-rss/stringer/pull/1548","tags":[]},{"url":"https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q","tags":[]},{"url":"https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q","tags":[]}],"hasPoc":true,"ai":null}