CVE-2026-119712
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 30, 2026
Description
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
pipeshub-aipipeshub-ai |
|
References
- GitHub Security Advisory (GHSA-mp2g-r37c-fx9q)vendor-advisory
- https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389a5a5886613patch
- https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/modules/parsers/image_parser/image_parser.pytechnical-description
- pipeshub-ai v0.10.0 Release Notesrelease-notes
- https://github.com/pipeshub-ai/pipeshub-aiproduct
- VulnCheck Advisory: PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documentsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.