Executive brief
Garlic-Hub is a self-hosted platform used to manage digital signage networks, including content and playlists. A security flaw allows logged-in users to force the server to make unauthorized requests to internal network services. This could allow an attacker to scan private internal networks, identify sensitive internal services, and steal data from those services by saving it into the public media pool.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Garlic-Hub's 'uploadFromUrl' endpoint. Authenticated users can provide a malicious URL that causes the server to issue arbitrary HTTP requests to internal network resources. Because the server stores the responses from these requests in a publicly accessible media pool, attackers can perform internal port scanning, service fingerprinting, and data exfiltration from internal services that are not otherwise exposed to the internet. The vulnerability is addressed in version 1.1 by implementing better validation on the URL input.
Affected products
- Garlic-Signage Garlic-Hub < 1.1
Timeline
- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD
- 2026-06-11: patched: Version 1.1 released with fix