CVE-2026-54546

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

PT-2026-60895

Name of the Vulnerable Software and Affected Versions CloudTAK versions prior to 13.22.1 Description CloudTAK contains a server-side request forgery SSRF flaw in the authenticated PUT /api/basemap endpoint. The importBasemapURL function in api/routes/basemap.ts uses fetchurl to retrieve content...