CVE-2026-108770

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component.

• CWE-918

• https://github.com/appwrite/appwrite/
• https://github.com/appwrite/appwrite/commit/393255e7302ae5503331d45802e2eee01c6a47fe
• https://github.com/appwrite/appwrite/pull/13995
• https://github.com/appwrite/appwrite/releases/tag/2.4.0
• https://github.com/godzeo/vulhub/issues/2
• https://vuldb.com/cve/CVE-2026-108770
• https://vuldb.com/submit/958017
• https://vuldb.com/vuln/416552
• https://vuldb.com/vuln/416552/cti

Published

Oct 11, 2026

Last Modified

Oct 11, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108759mistral.rs 0.9.0 through 0.9.4 contains a link following vul…6.8
• CVE-2026-10876A weakness has been identified in SourceCodester Ship Ferry …6.3
• CVE-2026-108760LlamaFarm through 0.0.34 contains an insecure default config…7.6
• CVE-2026-108768A vulnerability was identified in zhayujie CowAgent up to 2.…4.3
• CVE-2026-108769A security flaw has been discovered in zhayujie CowAgent up …4.3
• CVE-2026-10877A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-108772A security vulnerability has been detected in bleenco abstru…5.3
• CVE-2026-108773A vulnerability was detected in erzhongxmu JEEWMS up to 2026…6.3
• CVE-2026-10878A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.7…8.8
• CVE-2026-10879DBI versions before 1.648 for Perl have a heap overflow when…9.8
• CVE-2026-1088The Login Page Editor plugin for WordPress is vulnerable to …4.3
• CVE-2026-10880OSNexus QuantaStor SDS Manager is vulnerable to SQL injectio…9.8