CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

• CWE-918
• CWE-918

• https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9aExploit, Third Party Advisory
• https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdbExploit, Third Party Advisory
• https://github.com/appwrite/appwriteProduct
• https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKAExploit, Third Party Advisory
• https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9aExploit, Third Party Advisory
• https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdbExploit, Third Party Advisory
• https://github.com/appwrite/appwriteProduct
• https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKAExploit, Third Party Advisory

Published

Mar 31, 2023

Last Modified

Jul 9, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27148A stored cross-site scripting (XSS) vulnerability in the Adm…4.8
• CVE-2023-27149A stored cross-site scripting (XSS) vulnerability in Enhance…4.8
• CVE-2023-2715The Groundhogg plugin for WordPress is vulnerable to unautho…4.3
• CVE-2023-27150openCRX 5.2.0 was discovered to contain a cross-site scripti…5.4
• CVE-2023-27151openCRX 5.2.0 was discovered to contain an HTML injection vu…6.1
• CVE-2023-27152DECISO OPNsense 23.1 does not impose rate limits for authent…9.8
• CVE-2023-2716The Groundhogg plugin for WordPress is vulnerable to unautho…5.4
• CVE-2023-27160forem up to v2022.11.11 was discovered to contain a Server-S…7.2
• CVE-2023-27161Jellyfin up to v10.7.7 was discovered to contain a Server-Si…7.5
• CVE-2023-27162openapi-generator up to v6.4.0 was discovered to contain a S…9.1
• CVE-2023-27163request-baskets up to v1.2.1 was discovered to contain a Ser…6.5
• CVE-2023-27164An arbitrary file upload vulnerability in Halo up to v1.6.1 …4.8