# CVE-2026-67173: Pivotick SSRF via unvalidated node imagePath URL schemes

Source: https://junglewise.ai/threats/cve-2026-67173-pivotick-ssrf-via-unvalidated-node-imagepath-url-schemes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-67173 · Severity: info · CVSS 5.1 · Published 2026-07-28

Pivotick, a graph visualization tool, contains a flaw in how it handles image paths within graph data. An attacker can provide a specially crafted graph file that, when viewed by a user, forces the user's browser to make unintended requests to external or internal websites. This could lead to the disclosure of private network information or be used to track users.

Technologies: [Pivotick](https://junglewise.ai/threats/technologies/pivotick). Vendors: [Pivotick](https://junglewise.ai/threats/vendors/pivotick).

## Quick answers

**Is CVE-2026-67173 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67173 being exploited in the wild.

**How severe is CVE-2026-67173?** Informational severity, with a CVSS score of 5.1, published 28 July 2026.

**Which products and versions are affected?** Pivotick <= 1.4.0.

**Is there a fix for CVE-2026-67173?** A patch was published on 2026-07-28: Fixed in commit 2a6ad28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67173 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67173?** Check whether you run Pivotick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) / URI injection vulnerability exists in Pivotick due to insufficient validation of the 'imagePath' attribute in graph data. When the application renders SVG image resources, it assigns these unvalidated paths directly to the image source. An attacker can exploit this by crafting graph data with malicious URI schemes (e.g., pointing to internal network resources or tracking pixels). Exploitation requires a victim to load or render the malicious graph data. The issue is addressed in a patch that implements an allowlist for URI schemes (http, https, data, and blob) and normalizes whitespace/control characters.

## Affected products

- Pivotick Pivotick <= 1.4.0

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched: Fixed in commit 2a6ad28

## References

- [https://github.com/Pivotick/Pivotick/commit/2a6ad284e7ed69ab845087febe47f4cc82f13e1c](https://github.com/Pivotick/Pivotick/commit/2a6ad284e7ed69ab845087febe47f4cc82f13e1c)

## Related threats

- [Pivotick DOM-based XSS in UI element and icon rendering](https://junglewise.ai/threats/cve-2026-67174-pivotick-dom-based-xss-in-ui-element-and-icon-rendering)
- [Pivotick prototype pollution and DoS in graph processing](https://junglewise.ai/threats/cve-2026-66922-pivotick-prototype-pollution-and-dos-in-graph-processing)
- [Pivotick Markdown node-reference renderer cross-site scripting](https://junglewise.ai/threats/cve-2026-66921-pivotick-markdown-node-reference-renderer-cross-site-scripting)
- [Pivotick uncontrolled recursion in graph and node processing](https://junglewise.ai/threats/cve-2026-66920-pivotick-uncontrolled-recursion-in-graph-and-node-processing)
- [Pivotick Cross-Site Scripting in Node Modals](https://junglewise.ai/threats/cve-2026-66919-pivotick-cross-site-scripting-in-node-modals)