← Back to search

CVE-2026-118172

— UNSCOREDpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.