Vulnerability · Published Oct 20, 2026 · Assigned by TYPO3

CVE-2026-112237Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

Medium 6.9

In plain English

A medium-severity server-side request forgery in Extension "Kitodo.Presentation" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Kitodo.Presentation"	7.0.0 – before 7.0.20 – before 6.0.1

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-032 vendor-advisory