CVE-2023-41055

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery (SSRF) vulnerability in the `engines/google/text.php` and `engines/duckduckgo/text.php` files in versions before commit be59098abd119cda70b15bf3faac596dfd39a744. This vulnerability allows remote attackers to request the server to send HTTP GET requests to arbitrary targets and conduct Denial-of-Service (DoS) attacks via the `wikipedia_language` cookie. Remote attackers can request the server to download large files to reduce the performance of the server or even deny access from legitimate users. This issue has been patched in https://github.com/Ahwxorg/LibreY/pull/9. LibreY hosters are advised to use the latest commit. There are no known workarounds for this vulnerability.

• CWE-918

• https://github.com/Ahwxorg/LibreY/pull/9Patch
• https://github.com/Ahwxorg/LibreY/security/advisories/GHSA-xfj6-4vp9-8rgcExploit, Patch, Vendor Advisory
• https://github.com/Ahwxorg/LibreY/pull/9Patch
• https://github.com/Ahwxorg/LibreY/security/advisories/GHSA-xfj6-4vp9-8rgcExploit, Patch, Vendor Advisory

Published

Sep 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4105Mattermost fails to delete the attachments when deleting a m…4.3
• CVE-2023-41050AccessControl provides a general security framework for use …7.7
• CVE-2023-41051In a typical Virtual Machine Monitor (VMM) there are several…4.7
• CVE-2023-41052Vyper is a Pythonic Smart Contract Language. In affected ver…5.3
• CVE-2023-41053Redis is an in-memory database that persists on disk. Redis …3.3
• CVE-2023-41054LibreY is a fork of LibreX, a framework-less and javascript-…9.1
• CVE-2023-41056Redis is an in-memory database that persists on disk. Redis …8.1
• CVE-2023-41057hyper-bump-it is a command line tool for updating the versio…5.5
• CVE-2023-41058Parse Server is an open source backend server. In affected v…7.5
• CVE-2023-4106Mattermost fails to check if the requesting user is a guest …6.5
• CVE-2023-41060A type confusion issue was addressed with improved checks. T…8.8
• CVE-2023-41061A validation issue was addressed with improved logic. This i…7.8