CVE-2026-49328

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...

cn.sinozg.applet:applet-poi-boot-starter (3.2.12), com.github.mengweijin:vita-admin (>=2.0.0-m3, <=2.0.0-m5) +12 more potentially affected by CVE-2026-49328 via org.apache.fesod:fesod-sheet (>=2.0.0-incubating, <=2.0.1-incubating)

org.apache.fesod:fesod-sheet MAVEN version =2.0.0-incubating, =2.0.0-m3, =2.0.0-m3, =4.6.64, =2.0.2, =2.0.2, =2.0.2, =1.0.0, =2.0.2, =1.1.0, =2.1.0, =2.0.0-incubating, =2.0.1-incubating Source cves: CVE-2026-49328 Source advisory: GHSA-VQC2-C9JH-3JJV...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the UrlImageConverter process. An attacker can access internal or restricted network resources by supplying a crafted image URL. Remediation Upgrade org.apache.fesod:fesod-sheet to version...

CVE-2026-49328

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...

CVE-2026-49328

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...

CVE-2026-49328

Apache Fesod (Incubating) contains a Server-Side Request Forgery (SSRF) vulnerability in the UrlImageConverter component in versions prior to 2.0.2-incubating . The flaw allows an attacker to provide a malicious image URL, tricking the server into initiating outbound network requests to internal ...

CVE-2026-49328 Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...

CVE-2026-49328

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...

PT-2026-45399

Name of the Vulnerable Software and Affected Versions Apache Fesod Incubating fesod-sheet versions prior to 2.0.2-incubating Description Server-Side Request Forgery SSRF in the UrlImageConverter component allows attackers to trigger outbound network requests to internal or restricted resources by...

CVE-2026-49328: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...