Is CVE-2026-122008 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122008 being exploited in the wild.

How severe is CVE-2026-122008?

Medium severity, with a CVSS score of 5, published 4 November 2026.

Which products and versions are affected?

Oqtane Framework before 10.3.0.

Is there a fix for CVE-2026-122008?

Yes: fixed in 10.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122008 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-122008?

Check whether you run Oqtane Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122008: Oqtane Framework server-side request forgery in UploadFile

CVE-2026-122008 · Severity: medium · CVSS 5 · Published 2026-11-04

Oqtane Framework is an open-source CMS and application framework used to build web and mobile applications. A server-side request forgery vulnerability in the file upload endpoint allows authenticated users to trick the server into fetching arbitrary URLs and saving the responses as files, potentially exposing sensitive internal data such as cloud metadata or management interfaces. An attacker could exploit this to access internal systems, enumerate network resources, or exfiltrate confidential information.

Technologies: Oqtane Framework. Vendors: Oqtane.

Quick answers

Is CVE-2026-122008 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122008 being exploited in the wild.
How severe is CVE-2026-122008?: Medium severity, with a CVSS score of 5, published 4 November 2026.
Which products and versions are affected?: Oqtane Framework before 10.3.0.
Is there a fix for CVE-2026-122008?: Yes: fixed in 10.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122008 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-122008?: Check whether you run Oqtane Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.3.0

Technical details

The vulnerability exists in the UploadFile endpoint of FileController.cs, where a caller-controlled URL parameter is passed to HttpClient.GetStreamAsync without validation of the scheme, host, or IP address. An authenticated user can supply a malicious URL (e.g., pointing to cloud instance metadata services or localhost management interfaces), and the server will fetch and save the response as a file in the attacker's user folder, which can then be retrieved via the download endpoint. This allows exfiltration of internal data or enumeration of internal network hosts and ports.

Affected products

Oqtane Framework before 10.3.0

Timeline

2026-11-04: disclosed
2026-11-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.