Executive brief
SveltyCMS is a headless CMS platform used for managing website content. The /mediagallery/upload-media endpoint contains a server-side request forgery (SSRF) vulnerability that could allow an attacker to make unauthorized outbound network requests from the server, potentially accessing internal cloud metadata, private APIs, or other restricted resources.
Technical details
A server-side request forgery (CWE-918) vulnerability exists in the media upload functionality of SveltyCMS 0.0.6, specifically in the /mediagallery/upload-media endpoint's file upload component. The vulnerability stems from insufficient validation of URLs used in remote media operations, allowing attackers to craft malicious requests that trigger the server to fetch from attacker-specified destinations. The fix implemented in commit 05b4f9e introduces strict egress URL validation via `validateEgressUrl()` and `safeFetch()` helpers that explicitly block access to cloud metadata endpoints (169.254.169.254), loopback addresses, RFC1918 private ranges, and DNS rebinding attacks. The attack is network-accessible and requires no authentication, enabling remote exploitation to probe internal infrastructure.
Affected products
- SveltyCMS SveltyCMS 0.0.6
Timeline
- 2026-09-18: disclosed
- 2026-08-07: patched: Commit 05b4f9efeb79e9d72a693232334d7529687f896f