Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-122008Oqtane Framework before 10.3.0 SSRF via File Upload From URL

Medium 5.0

In plain English

A medium-severity server-side request forgery in oqtane.framework from oqtane. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.

Affected products (as reported)

Vendor	Product	Versions
oqtane	oqtane.framework	1.0.0 – before 10.3.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

Vendor Patch patch
Vendor Blog release-notes
VulnCheck Advisory: Oqtane Framework before 10.3.0 SSRF via File Upload From URL third-party-advisory