Executive brief
Webstudio is an open-source website builder and visual design platform. An unauthenticated attacker can exploit server-side request forgery (SSRF) vulnerabilities in the image, video, and asset proxy endpoints to read sensitive cloud instance metadata, access internal services, and perform network reconnaissance on the hosting infrastructure. This could lead to unauthorized access to internal systems and cloud credentials.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the `/cgi/image`, `/cgi/video`, and `/cgi/asset` proxy routes in Webstudio through version 0.296.0. The vulnerable code accepts arbitrary URLs via these endpoints and attempts to fetch them without proper validation when the `RESIZE_ORIGIN` environment variable is unset. An attacker can supply malicious URLs pointing to internal services, cloud metadata endpoints (e.g., AWS IMDSv1/v2), or other network-accessible hosts to exfiltrate sensitive information. No authentication is required to exploit this vulnerability. Patches or upgraded versions should restrict the URLs that can be fetched to a whitelist of allowed origins.
Affected products
- Webstudio Webstudio through 0.296.0
Timeline
- 2026-09-05: disclosed