VulnerabilityDeferred

CVE-2026-42141

Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources.

HIGH 7.7EPSS 0.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-918
Source: security-advisories@github.com

References

https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.