CVE-2026-41171highCWE-918

CVE-2026-41171: high-severity vulnerability in squidex

SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient

Published · Updated

Follow this CVE+ Monitor squidex

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.2%
Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery (SSRF) vulnerability due to missing SSRF protection on the `Jint` HTTP client used by scripting engine functions (`getJSON`, `request`, etc.). An authenticated user with low privileges (e.g., schema editing permissions) can force the server to make arbitrary outbound HTTP requests to attacker-controlled or internal endpoints. This allows access to internal services and cloud metadata endpoints (e.g., IMDS), potentially leading to credential exposure and lateral movement. Version 7.23.0 contains a fix.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Squidex · squidex
Related CVEs — squidex

In the same product, most dangerous first.

CVE-2023-46253CRITICALRemote code execution in SquidexEPSS 1.9%CVE-2023-46744MEDIUMStored Cross-site Scripting in SquidexEPSS 0.6%CVE-2023-46252MEDIUMCross-Site Scripting (XSS) via postMessage Handler in SquidexEPSS 0.6%CVE-2026-24736CRITICALSquidex has Server-Side Request Forgery (SSRF) Issue in Webhook ConfigurationEPSS 0.5%CVE-2026-41177MEDIUMSquidex has Blind SSRF via file:// Protocol in Restore API leading to Local File InteractionEPSS 0.3%CVE-2026-41170HIGHSquidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External RequestsEPSS 0.2%