Description

Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-24T12:16:54.893Z",
  "pubdate": "2026-08-24T12:16:54.893Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Shared Files plugin affecting versions <= 1.7.69. This security flaw enables authenticated users with contributor-level privileges or higher to manipulate server-side HTTP requests, forcing the underlying application to dispatch arbitrary network traffic to internal or external resources.\nThe primary impact of this vulnerability includes potential unauthorized access to internal network services, metadata endpoints, and backend systems that are typically isolated from the public internet. By abusing the shared files functionality, malicious actors can leverage the server as a proxy to perform reconnaissance, interact with loopback interfaces, or execute port scanning against internal infrastructure.\nThe risk implication is significant as it compromises the network boundary security posture of the host environment. Exploitation requires authenticated access with specific contributor privileges within the target application, limiting unauthenticated exposure but presenting a severe risk from malicious insiders or compromised low-privileged accounts.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and lack of output sanitization on user-supplied URLs within the Shared Files component. When processing file sharing or remote resource fetching operations, the application fails to adequately restrict or parse the destination addresses before initiating outbound network requests.\nThe vulnerable component resides in the server-side request handling logic of versions <= 1.7.69, which improperly trusts parameters supplied during file management processes. Authentication and privilege requirements mandate that the attacker holds at least a contributor-level role to interact with the vulnerable functionality, exposing the system to authenticated threat actors.\nThe attack flow proceeds in a sequential manner. First, an authenticated attacker with contributor privileges crafts a malicious HTTP request targeting the shared files interface, supplying an arbitrary URL pointing to an internal resource (such as http://127.0.0.1/ or cloud metadata services) or an external listener under the attacker's control. Second, the server-side application processes the input without verifying the legitimacy or safety of the destination scheme and host. Third, the application initiates an outbound TCP connection and HTTP request from its own network context to the specified target. Finally, the application may inadvertently return the response data or error messages to the user, or execute asynchronous actions based on the response, facilitating data exfiltration, internal service enumeration, or side-channel reconnaissance.\nNetwork exposure is inherent to the application server hosting the vulnerable software, as it must possess outbound networking capabilities to interact with remote resources. Post-exploitation impact depends heavily on network segmentation and hardening; however, successful SSRF exploitation frequently leads to unauthorized data access, internal API abuse, and the circumvention of perimeter firewalls."
}