CVE-2026-41170

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" `HttpClient` without any SSRF protection. A malicious or compromised admin can use this endpoint to probe internal network services, access cloud metadata endpoints, or perform internal reconnaissance. The vulnerability is authenticated (Admin-only) but highly impactful, allowing potential access to sensitive internal resources. Version 7.23.0 contains a fix.

• CWE-918

• https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4
• https://github.com/Squidex/squidex/security/advisories/GHSA-6q6m-7h5j-jq4g
• https://github.com/Squidex/squidex/security/advisories/GHSA-6q6m-7h5j-jq4g

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41163bubblewrap is a low-level unprivileged sandboxing tool. From…7
• CVE-2026-41164nuts-node is the reference implementation of the Nuts specif…4.4
• CVE-2026-41166OpenRemote is an open-source internet-of-things platform. Pr…7
• CVE-2026-41167Jellystat is a free and open source Statistics App for Jelly…9.1
• CVE-2026-41168pypdf is a free and open-source pure-python PDF library. An …5.3
• CVE-2026-4117The CalJ plugin for WordPress is vulnerable to Missing Autho…5.3
• CVE-2026-41171Squidex is an open source headless content management system…7.3
• CVE-2026-41172Squidex is an open source headless content management system…7.3
• CVE-2026-41173The AWS X-Ray Remote Sampler package provides a sampler whic…5.9
• CVE-2026-41174Traefik is an HTTP reverse proxy and load balancer. Prior to…6.4
• CVE-2026-41175Statamic is a Laravel and Git powered content management sys…8.1
• CVE-2026-41176Rclone is a command-line program to sync files and directori…9.8