Vulnerability · Published May 12, 2026 · Assigned by GitHub_M

CVE-2026-41195mosparo: Rule package source URL stored SSRF enables internal HTTP probing

Medium 5.0

In plain English

A medium-severity server-side request forgery in mosparo from mosparo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and does not restrict private or loopback destinations, this becomes a stored SSRF primitive that can be turned into an internal HTTP probing oracle. This vulnerability is fixed in 1.4.13.

Affected products (as reported)

Vendor	Product	Versions
mosparo	mosparo	< 1.4.13

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/mosparo/mosparo/security/advisories/GHSA-92fh-26qf-r8rg x_refsource_CONFIRM