CVE-2026-41177

🗓️ 22 Apr 2026 21:24:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 36 Views🌐 WEB

Before version 7.23.0, Squidex Restore API allowed blind server side request forgery via file protocol, enabling local file access by an authenticated administrator; fixed in 7.23.0.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2026-41177	25 Apr 202620:50	–	githubexploit
attackerkb	CVE-2026-41177	22 Apr 202621:24	–	attackerkb
Circl	CVE-2026-41177	25 Apr 202621:02	–	circl
CNNVD	Squidex 安全漏洞	22 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-41177 Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction	22 Apr 202621:24	–	cvelist
EUVD	EUVD-2026-25110	22 Apr 202621:24	–	euvd
Kitploit	CVE-2026-41177-Squidex-CMS	1 Oct 202617:17	–	kitploit
NVD	CVE-2026-41177	22 Apr 202622:16	–	nvd
Positive Technologies	PT-2026-34572	22 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-41177: External Control of File Name or Path	22 Apr 202600:00	–	rapid7

Vulners

Node

squidex.io squidexRange<7.23.0

[
  {
    "vendor": "Squidex",
    "product": "squidex",
    "versions": [
      {
        "version": "< 7.23.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4
github	www.github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5

Parameter	Position	Path	Description	CWE
Url	request body	/api/apps/restore/	Blind SSRF via Restore API unvalidated URL parameter allowing file:// URIs to access local filesystem.	CWE-73, CWE-918

17 Jun 2026 10:46Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.5

EPSS0.00426

SSVC