Strix
70.4K

CVE-2026-112358

MEDIUMCVSS 4.1/10EPSS 0.25%

Last modified

CVE-2026-112358 is a medium-severity vulnerability rated 4.1/10 on the CVSS scale. A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. EPSS estimates a 0.25% chance of exploitation in the next 30 days.

Description

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument img_url/image_url can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: "[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release."

Metrics

CVSS 3.1
4.1/10

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

CVSS 4.0
2.1/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.25%

15.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
TiBilletLespass10e87909c5d526dffa6d424c104fc12860740537

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-112358?
A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument img_url/image_url can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: "[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release."
How severe is CVE-2026-112358?
CVE-2026-112358 has a CVSS score of 4.1/10 (MEDIUM severity). The EPSS model estimates a 0.25% probability of exploitation in the next 30 days.
How do I fix CVE-2026-112358?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-112358?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST