CVE-2026-92931

Summary

The flaw is a Server-Side Request Forgery (SSRF) vulnerability in the Progress @progress/sitefinity-nextjs-sdk npm package, allowing remote attackers to make server-side requests to attacker-controlled hosts, potentially exposing sensitive information.

Exploitability

Exploitation requires the attacker to have access to the application and control over the input that triggers the SSRF. Precondition is the use of affected package versions.

Blast radius

If exploited, the vulnerability could lead to unauthorized access to sensitive information hosted on attacker-controlled servers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 15.4.8638 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.