Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck
CVE-2026-107273Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
Medium 4.3
In plain English
A medium-severity server-side request forgery in gophish from gophish. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- Researcher Disclosure technical-description, exploit
- https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/dialer/dialer.go#L82-L86 technical-description
- https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/import.go#L102-L125 technical-description
- https://github.com/gophish/gophish product
- VulnCheck Advisory: Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site third-party-advisory