Is CVE-2026-82667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82667 being exploited in the wild.

How severe is CVE-2026-82667?

Medium severity, with a CVSS score of 4.7, published 31 August 2026.

Which products and versions are affected?

Yaojingang GEOFlow up to 2.1.0.

Is there a fix for CVE-2026-82667?

A patch was published on 2026-07-17: Patch released in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82667 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82667?

Check whether you run Yaojingang GEOFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82667: yaojingang GEOFlow server-side request forgery in endpoint validation

CVE-2026-82667 · Severity: medium · CVSS 4.7 · Published 2026-08-31

GEOFlow is an open-source content distribution platform used for managing and publishing geo-targeted content. A vulnerability in the endpoint validation function allows attackers to manipulate the endpoint URL parameter, enabling server-side request forgery attacks that could be used to scan internal networks, access internal services, or exfiltrate sensitive data from the server's perspective.

Technologies: Yaojingang GEOFlow. Vendors: Yaojingang.

Quick answers

Is CVE-2026-82667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82667 being exploited in the wild.
How severe is CVE-2026-82667?: Medium severity, with a CVSS score of 4.7, published 31 August 2026.
Which products and versions are affected?: Yaojingang GEOFlow up to 2.1.0.
Is there a fix for CVE-2026-82667?: A patch was published on 2026-07-17: Patch released in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82667 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82667?: Check whether you run Yaojingang GEOFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability exists in the DistributionController.isValidHttpEndpoint function within app/Services/GeoFlow/GenericHttpEndpointResolver.php. The vulnerability arises from insufficient validation of the endpoint_url parameter, allowing an attacker to supply a malicious URL that causes the server to make requests to unintended destinations. The attack is network-accessible and requires no authentication. An attacker can exploit this to probe internal network resources, access internal services, or facilitate data exfiltration. A patch is available in version 2.1.1 (commit 67abfd864a15d169a78429f3290c91cb3b93e849); upgrading is recommended.

Affected products

yaojingang GEOFlow up to 2.1.0

Timeline

2026-08-31: disclosed
2026-07-17: patched: Patch released in version 2.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.