CVE-2026-49328

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-49328
Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fesod.apache.org/docs/download Product
https://github.com/apache/fesod/pull/917 Issue Tracking Patch
https://github.com/apache/fesod/releases/tag/2.0.2-incubating Release Notes
https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/01/4
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:fesod:*:*:*:*:*:*:*:*
History

01 Jun 2026, 15:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/06/01/4 -

01 Jun 2026, 14:10

Type Values Removed Values Added
CPE cpe:2.3:a:apache:fesod:*:*:*:*:*:*:*:*
First Time Apache
Apache fesod
References () https://fesod.apache.org/docs/download - () https://fesod.apache.org/docs/download - Product
References () https://github.com/apache/fesod/pull/917 - () https://github.com/apache/fesod/pull/917 - Issue Tracking, Patch
References () https://github.com/apache/fesod/releases/tag/2.0.2-incubating - () https://github.com/apache/fesod/releases/tag/2.0.2-incubating - Release Notes
References () https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj - () https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj - Mailing List, Vendor Advisory

01 Jun 2026, 13:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

01 Jun 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-01 11:16

Updated : 2026-06-01 15:16

NVD link : CVE-2026-49328

Mitre link : CVE-2026-49328

CVE.ORG link : CVE-2026-49328

JSON object : View

Products Affected

apache

  • fesod
CWE
CWE-918

Server-Side Request Forgery (SSRF)