CVE-2026-107273
Last modified
CVE-2026-107273 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages..
Description
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-107273?
How severe is CVE-2026-107273?
How do I fix CVE-2026-107273?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10726Cato Windows SDP Client before version 6.12.6 contains an ar…6.8
- CVE-2026-107269Gophish through 0.12.1 contains a timing discrepancy vulnera…3.7
- CVE-2026-10727An OS command injection vulnerability in Ivanti EPMM before …7.2
- CVE-2026-107270Gophish through 0.12.1 contains an insecure direct object re…7.1
- CVE-2026-107271Gophish through 0.12.1 contains a rate limit bypass vulnerab…5.3
- CVE-2026-107272Gophish through 0.12.1 contains stored and reflected cross-s…4.7
- CVE-2026-107276MISP contains a race condition in the email-based one-time p…6.3
- CVE-2026-107278MISP contains a validation flaw in its object synchronizatio…5.3
- CVE-2026-10729An HTML injection vulnerability in the notification email fo…1.2
- CVE-2026-1073The Purchase Button For Affiliate Link plugin for WordPress …4.3
- CVE-2026-10731SQL injection in the ‘two_steps_auth_code’ parameter process…9.3
- CVE-2026-107313pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7…4.2
Are you affected by CVE-2026-107273?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST