Description

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T05:16:46.903Z",
  "pubdate": "2026-08-28T05:16:46.903Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in wallabag, a self-hosted read-it-later application, affecting versions 2 through 2.6.14. The flaw exists within the PDF export functionality of the application, where user-supplied inputs in the 'title' or 'content' fields are inadequately sanitized or validated before processing. An attacker with the ability to modify or submit articles with specifically crafted titles or content can exploit this vulnerability to force the hosting server to make unauthorized outbound HTTP or network requests.\nThis capability allows attackers to target internal systems, query metadata services, scan internal ports, or potentially access restricted network resources that are otherwise inaccessible from the public internet. Because the export engine processes these fields to render the final document, the application acts as a proxy for the attacker's requests. The risk implications are severe, potentially leading to information disclosure, internal reconnaissance, and lateral movement within the hosting infrastructure. Exploitation typically requires the ability to create or edit articles containing malicious payloads, which are then processed during the PDF generation phase.",
  "technicalDetails": "The root cause of this vulnerability lies in the input handling and document rendering architecture of wallabag versions 2 through 2.6.14. Specifically, the vulnerability manifests within the PDF export module. Wallabag allows users to save articles, which includes storing their titles and body content. When a user requests to export an article to PDF format, the backend application utilizes a PDF generation engine to render the article's HTML content and metadata, including the title, into a document structure.\nDuring this rendering process, the PDF export engine parses the 'title' and 'content' fields. If these fields contain maliciously crafted inputs, such as embedded HTML elements (e.g., image, iframe, link, or script tags) referencing external or internal URLs, the parser attempts to resolve and fetch these resources to include them in the generated PDF file. Because wallabag fails to properly sanitize, strip, or validate these inputs before passing them to the PDF generator, the backend server initiates outbound network connections to the addresses specified in the payload.\nThe attack flow typically unfolds as follows: First, an attacker identifies a target wallabag instance (versions 2 through 2.6.14) and logs in, or leverages an endpoint allowing article creation or import. Second, the attacker creates or modifies an article, injecting a malicious payload into the 'title' or 'content' field. This payload contains references to target URLs, which can point to internal network resources (such as loopback interfaces, private IP ranges, or cloud metadata endpoints). Third, the attacker triggers the PDF export function for the modified article.\nNext, the wallabag backend initiates the document conversion process, and the underlying PDF rendering engine parses the unsanitized 'title' or 'content' fields. Upon encountering the crafted references, the server makes synchronous or asynchronous HTTP/HTTPS requests to the targeted internal or external resources. Finally, the response from the target server may be rendered directly into the generated PDF document, allowing the attacker to read sensitive data (such as local configuration files, cloud metadata, or internal application responses) upon downloading the exported file, or the SSRF may be used blindly for internal port scanning and service enumeration.\nThis vulnerability requires network access to the wallabag instance and the privileges necessary to create or edit article contents. The impact of successful exploitation includes exposure of internal network topologies, unauthorized access to cloud provider metadata services, potential remote code execution depending on internal service exposures, and bypassing of network segmentation controls."
}