# CVE-2026-112237: TYPO3 Kitodo.Presentation server-side request forgery in proxy endpoint

Source: https://junglewise.ai/threats/cve-2026-112237-the-extension-provides-a-public-proxy-endpoint-that-fetches-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112237 · Severity: info · Published 2026-10-20

Kitodo.Presentation is a TYPO3 extension for presenting digital library content. The extension contains a public proxy endpoint that can be exploited by unauthenticated attackers to make the server fetch arbitrary URLs, allowing probing of internal networks and services. While response bodies are not disclosed, attackers can use status codes and headers to map internal infrastructure.

Vendors: [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-112237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112237 being exploited in the wild.

**How severe is CVE-2026-112237?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Typo3 Kitodo.Presentation 6.0.0 and below, 7.0.0 to 7.0.1.

**Is there a fix for CVE-2026-112237?** Yes: fixed in Kitodo.Presentation 6.0.1, 7.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112237 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112237?** Check whether you run Typo3 Kitodo.Presentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Kitodo.Presentation 6.0.1, 7.0.2

## Technical details

The proxy endpoint fails to apply authorization checks for one HTTP method, allowing unauthenticated attackers to control the URL being fetched via server-side request forgery (SSRF). The vulnerability is network-accessible with no authentication or user interaction required. Attackers can probe internal and external hosts by observing response status codes and selected headers, enabling reconnaissance of internal systems.

## Affected products

- TYPO3 Kitodo.Presentation 6.0.0 and below, 7.0.0 to 7.0.1

## Timeline

- 2026-10-20: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://typo3.org/security/advisory/typo3-ext-sa-2026-032](https://typo3.org/security/advisory/typo3-ext-sa-2026-032)