CVE-2026-55372

An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the "X Forwarded-Host" and "X-Forwarded-Proto" request headers. The forwarded host is used, without validation, to build the URL that "serverinfoupdate" fetches with cURL, resulting...