Executive brief
Pivotick, a graph visualization tool, contains a flaw in how it handles image paths within graph data. An attacker can provide a specially crafted graph file that, when viewed by a user, forces the user's browser to make unintended requests to external or internal websites. This could lead to the disclosure of private network information or be used to track users.
Technical details
A Server-Side Request Forgery (SSRF) / URI injection vulnerability exists in Pivotick due to insufficient validation of the 'imagePath' attribute in graph data. When the application renders SVG image resources, it assigns these unvalidated paths directly to the image source. An attacker can exploit this by crafting graph data with malicious URI schemes (e.g., pointing to internal network resources or tracking pixels). Exploitation requires a victim to load or render the malicious graph data. The issue is addressed in a patch that implements an allowlist for URI schemes (http, https, data, and blob) and normalizes whitespace/control characters.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched: Fixed in commit 2a6ad28