{"id":"CVE-2026-107460","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-107460","generatedAt":"2026-10-28T01:12:34.171Z","title":"Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding.","description":"Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.","published":"2026-10-13T15:17:32.000Z","lastModified":"2026-10-20T18:17:17.000Z","status":"Awaiting Analysis","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-918"],"affected":[],"epss":{"score":0.00407,"percentile":0.347,"date":"2026-10-26","history":[{"date":"2026-10-14","score":0.00183,"percentile":0.07343}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-20T19:15:07.000Z","detail":{"from":null,"score":"9.1","severity":"CRITICAL","fromSeverity":null},"summary":"Now scored CVSS 9.1 CRITICAL."},{"kind":"new","label":"New CVE","at":"2026-10-13T15:17:32.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-13T15:17:31.657Z"},"summary":"New CVE, critical severity (CVSS 9.1)."}],"references":[{"url":"https://cve.org/CVERecord?id=CVE-2026-49328","source":"security@apache.org"},{"url":"https://github.com/apache/fesod/pull/1035","source":"security@apache.org"},{"url":"https://github.com/apache/fesod/releases/tag/2.1.0-incubating","source":"security@apache.org"},{"url":"https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83","source":"security@apache.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107460","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}