# CVE-2026-111663: Chaskiq server-side request forgery in createUrlUpload

Source: https://junglewise.ai/threats/cve-2026-111663-chaskiq-through-2-0-3-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111663 · Severity: high · CVSS 8.6 · Published 2026-10-16

Chaskiq is a customer messaging platform that handles file uploads via GraphQL. An unauthenticated attacker can exploit the createUrlUpload mutation to make the server fetch arbitrary URLs, including internal cloud metadata endpoints, and return the results to the attacker. This could lead to exposure of sensitive credentials and configuration data stored in cloud infrastructure.

Technologies: [Chaskiq](https://junglewise.ai/threats/technologies/chaskiq). Vendors: [Chaskiq](https://junglewise.ai/threats/vendors/chaskiq).

## Quick answers

**Is CVE-2026-111663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111663 being exploited in the wild.

**How severe is CVE-2026-111663?** High severity, with a CVSS score of 8.6, published 16 October 2026.

**Which products and versions are affected?** Chaskiq through 2.0.3.

**Is there a fix for CVE-2026-111663?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111663 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111663?** Check whether you run Chaskiq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The createUrlUpload GraphQL mutation in Chaskiq 2.0.3 lacks URL validation and calls URI.open() on user-supplied input without authentication checks, enabling server-side request forgery. An attacker can submit internal URLs (e.g., http://169.254.169.254/latest/meta-data/) via POST /graphql, and the server fetches the content and stores it as an ActiveStorage blob, with the response accessible via the returned blob URL. The GraphQL controller's skip_before_action :verify_authenticity_token combined with commented-out authorization (before_action :doorkeeper_authorize!) permits unauthenticated requests.

## Affected products

- Chaskiq Chaskiq through 2.0.3

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb](https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb)
- [https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb](https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb)

## Related threats

- [Chaskiq server-side request forgery in oEmbed endpoint](https://junglewise.ai/threats/cve-2026-111662-chaskiq-through-2-0-3-contains-a-server-side-request-forgery)
- [Chaskiq missing authentication in stripeCreateIntent GraphQL mutation](https://junglewise.ai/threats/cve-2026-72536-chaskiq-missing-authentication-in-stripecreateintent-graphql)
- [Chaskiq stripeCustomerPortal authentication bypass in GraphQL API](https://junglewise.ai/threats/cve-2026-72535-chaskiq-stripecustomerportal-authentication-bypass-in-graphql-api)