CVE-2026-24736

Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a "Blind" SSRF into a "Full Read" SSRF. As of time of publication, no patched versions are available.

• CWE-918

• https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2wExploit, Vendor Advisory

Published

Jan 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2473Predictable bucket naming in Vertex AI Experiments in Google…7.7
• CVE-2026-24731WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-24732Files or Directories Accessible to External Parties, Incorre…6.6
• CVE-2026-24733Improper Input Validation vulnerability in Apache Tomcat. …3.7
• CVE-2026-24734Improper Input Validation vulnerability in Apache Tomcat Nat…7.5
• CVE-2026-24735Exposure of Private Personal Information to an Unauthorized …7.5
• CVE-2026-24737jsPDF is a library to generate PDFs in JavaScript. Prior to …8.1
• CVE-2026-24738gmrtd is a Go library for reading Machine Readable Travel Do…6.5
• CVE-2026-24739Symfony is a PHP framework for web and console applications …6.3
• CVE-2026-2474Crypt::URandom versions from 0.41 before 0.55 for Perl is vu…7.5
• CVE-2026-24740Dozzle is a realtime log viewer for docker containers. Prior…9.9
• CVE-2026-24741ConvertXis a self-hosted online file converter. In versions …8.1