CVE-2026-119712mediumCWE-918

CVE-2026-119712: medium-severity vulnerability in pipeshub-ai

PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

Published · Updated

Follow this CVE+ Monitor pipeshub-ai

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
from disclosure to weapon1 day
Published on NVDOct 30
1st PoC+1d
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
pipeshub-ai · pipeshub-ai
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — pipeshub-ai

In the same product, most dangerous first.

CVE-2025-67506CRITICALPipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File UploadEPSS 1.8%CVE-2026-119710HIGHPipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule RouteEPSS 0.4%CVE-2026-119711MEDIUMPipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For HeaderEPSS 0.2%