CVE-2026-3750

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3750
A security vulnerability has been detected in ContiNew Admin up to 4.2.0. This issue affects the function URI.create of the file continew-system/src/main/java/top/continew/admin/system/factory/S3ClientFactory.java of the component Storage Management Module. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:M/C:P/I:P/A:P

Exploitability : 6.4 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://vuldb.com/?ctiid.349728 Permissions Required VDB Entry
https://vuldb.com/?id.349728 Third Party Advisory VDB Entry
https://vuldb.com/?submit.768033 Third Party Advisory VDB Entry
https://www.notion.so/ContiNew-Admin-Server-Side-Request-Forgery-SSRF-vulnerability-in-storage-management-module-313ea92a3c4180b897f5e6352906bf1f Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:continew:continew_admin:*:*:*:*:*:*:*:*
History

10 Mar 2026, 18:57

Type Values Removed Values Added
References () https://vuldb.com/?ctiid.349728 - () https://vuldb.com/?ctiid.349728 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.349728 - () https://vuldb.com/?id.349728 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.768033 - () https://vuldb.com/?submit.768033 - Third Party Advisory, VDB Entry
References () https://www.notion.so/ContiNew-Admin-Server-Side-Request-Forgery-SSRF-vulnerability-in-storage-management-module-313ea92a3c4180b897f5e6352906bf1f - () https://www.notion.so/ContiNew-Admin-Server-Side-Request-Forgery-SSRF-vulnerability-in-storage-management-module-313ea92a3c4180b897f5e6352906bf1f - Exploit, Third Party Advisory
Summary
  • (es) Una vulnerabilidad de seguridad ha sido detectada en ContiNew Admin hasta la versión 4.2.0. Este problema afecta la función URI.create del archivo continew-system/src/main/java/top/continew/admin/system/factory/S3ClientFactory.java del componente Módulo de Gestión de Almacenamiento. La manipulación conduce a falsificación de petición del lado del servidor. El ataque es posible de ser llevado a cabo de forma remota. El exploit ha sido divulgado públicamente y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgación pero no respondió de ninguna manera.
First Time Continew continew Admin
Continew
CPE cpe:2.3:a:continew:continew_admin:*:*:*:*:*:*:*:*

08 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-08 17:16

Updated : 2026-03-10 18:57

NVD link : CVE-2026-3750

Mitre link : CVE-2026-3750

CVE.ORG link : CVE-2026-3750

JSON object : View

Products Affected

continew

  • continew_admin
CWE
CWE-918

Server-Side Request Forgery (SSRF)