CVE-2026-122008

The Oqtane Framework versions before 10.3.0 are vulnerable to a Server-Side Request Forgery (SSRF) in the UploadFile endpoint of FileController.cs. The root cause is a lack of validation on the scheme, host, or IP address of the url parameter passed to HttpClient.GetStreamAsync. This allows authe...