CVE-2026-111720

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

CVE-2026-111720

The fish-island-backend software (specifically versions through commit 7c61b78 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw exists in the GET /api/web/parse endpoint, where the application fails to properly validate the url parameter. Remote at...

EUVD-2026-103012

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...