CVE-2026-112299

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-918

• https://github.com/smrealms/smr/
• https://github.com/smrealms/smr/commit/cb402e7f4e70b617b59d8c55dbe926b951ceb4a8
• https://github.com/smrealms/smr/pull/2579
• https://vuldb.com/cve/CVE-2026-112299
• https://vuldb.com/submit/986838
• https://vuldb.com/vuln/422345
• https://vuldb.com/vuln/422345/cti
• https://vuldb.com/submit/986838

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112292CheckCle through 1.6.0 contains a missing authorization vuln…9.8
• CVE-2026-112293BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a …5.4
• CVE-2026-112294FlyCms through commit edfdf724 contains a missing authorizat…4.3
• CVE-2026-112295FlyCms through commit edfdf724 contains a mass assignment vu…5.4
• CVE-2026-112296FlyCms through commit edfdf724 contains a default credential…9.8
• CVE-2026-112297A flaw has been found in ptbsare anx-calibre-manager up to 1…4.3
• CVE-2026-1123A vulnerability was identified in Yonyou KSOA 9.0. Affected …9.8
• CVE-2026-11230Use after free in Extensions in Google Chrome prior to 149.0…8.8
• CVE-2026-112300A vulnerability was identified in DiffSK configobj up to 5.0…5.3
• CVE-2026-112301A security flaw has been discovered in orbitale imagemagick-…7.3
• CVE-2026-112302A weakness has been identified in kiwilan php-archive up to …6.3
• CVE-2026-112303GDevelop desktop app through 5.6.284 contains a credential l…4.3