CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177

CloudTAK is vulnerable to a full-read Server-Side Request Forgery (SSRF) in the ESRI helper family routes (e.g., POST /api/esri) prior to version 13.10.0 . The root cause is a lack of IP/DNS/hostname classification; the api/lib/esri.ts library uses a bare fetch on attacker-controlled URLs without...