CVE-2026-19927

OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

State: Published
Severity: 5.3 Medium
Published: Aug 16, 2026
Updated: Aug 17, 2026
Reserved: Aug 15, 2026

Description

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
OpenBoxesn/a	0.9.0Affected 0.9.1Affected 0.9.2Affected 0.9.3Affected 0.9.4Affected 0.9.5Affected 0.9.6Affected 0.9.7Affected 0.9.8-hotfix1Not affected 0.9.8Not affected

References

VDB-390178 | OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgeryvdb-entrytechnical-description
VDB-390178 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-19927 | CVE Analysis and Reportthird-party-advisory
Submit #871980 | Openboxes v0.9.7 Server-Side Request Forgerythird-party-advisory
https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-828r-3vx8-65wxrelated
https://github.com/OpenBoxes/OpenBoxes/pull/5944issue-trackingpatch
https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55cexploit
https://github.com/openboxes/openboxes/commit/a599007325efe780a21b3537ecce3ca25635c926patch
https://github.com/openboxes/openboxes/releases/tag/v0.9.8patch
https://github.com/OpenBoxes/OpenBoxes/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.