PT-2026-136992

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync withou...

CVE-2026-122008: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of…

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync withou...