CVE-2026-116069
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
918
Server-Side Request Forgery (SSRF)
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Potential Impacts:
Read Application Data
Execute Unauthorized Code Or Commands
Bypass Protection Mechanism
Applicable Platforms
Technologies:
Web Based, AI/ML, Web Server
https://github.com/Albert-Weasker/niubigeo
https://github.com/Albert-Weasker/niubigeo/blob/25d1f06e87c73d1df98bb82a2cfebac…
https://github.com/Albert-Weasker/niubigeo/blob/25d1f06e87c73d1df98bb82a2cfebac…
https://github.com/Albert-Weasker/niubigeo/commit/299b9e71881d445e976012ad75ecd…
https://github.com/Albert-Weasker/niubigeo/issues/242
https://github.com/Albert-Weasker/niubigeo/releases/tag/v0.3.2
https://www.vulncheck.com/advisories/niubigeo-before-0.3.2-unauthenticated-ssrf…