CVE-2026-82044

Summary

UTMStack contains a server-side request forgery vulnerability in its PDF generation service that allows authenticated attackers to access internal resources by crafting malicious URLs, potentially exposing sensitive backend data in generated PDF reports.

Exploitability

The exploit requires authentication and involves sending a crafted URL parameter to the /api/generate-pdf-report endpoint, making it moderately difficult to exploit without prior access to valid credentials.

Blast radius

If exploited, this vulnerability could expose internal backend services, OpenSearch clusters, or cloud metadata, potentially leading to data leakage from sensitive internal systems.

Detection

Monitor for requests to /api/generate-pdf-report with suspicious URL parameters in web server logs, particularly those containing internal IP addresses or service endpoints that should not be publicly accessible.

Prioritized remediation

Upgrade to UTMStack 11.2.16 or later to address this server-side request forgery vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.