CVE-2026-41177: medium-severity vulnerability in squidex
Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.3%
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied `Url` parameter, allowing the use of the `file://` protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Affected products
Squidex · squidexRelated CVEs — squidex
In the same product, most dangerous first.
CVE-2023-46253CRITICALRemote code execution in SquidexEPSS 1.9%CVE-2023-46744MEDIUMStored Cross-site Scripting in SquidexEPSS 0.6%CVE-2023-46252MEDIUMCross-Site Scripting (XSS) via postMessage Handler in SquidexEPSS 0.6%CVE-2026-24736CRITICALSquidex has Server-Side Request Forgery (SSRF) Issue in Webhook ConfigurationEPSS 0.5%CVE-2026-41170HIGHSquidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External RequestsEPSS 0.2%CVE-2026-41172HIGHSquidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)EPSS 0.2%