CVE-2026-49345

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.

• CWE-918

• https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6
• https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6

Published

Jun 19, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49338gonic is a music streaming server / free-software subsonic s…7.1
• CVE-2026-49339gonic is a music streaming server / free-software subsonic s…7.1
• CVE-2026-49340gonic is a music streaming server / free-software subsonic s…8.1
• CVE-2026-49342YARD is a documentation generation tool for the Ruby program…5.3
• CVE-2026-49343Klever-Go is the Go implementation of the Klever blockchain …5.9
• CVE-2026-49344Mercator is an open source web application that enables mapp…7.1
• CVE-2026-49346libde265 is an open source implementation of the h.265 video…7.1
• CVE-2026-49347Quest Bot is an opensource Discord Bot. Prior to version 1.1…5.3
• CVE-2026-49349regclient is a Docker and OCI Registry Client in Go. Prior t…6.8
• CVE-2026-4935The OttoKit: All-in-One Automation Platform WordPress plugin…8.6
• CVE-2026-493529Router is an AI router & token saver. From 0.2.21 until 0.4…9.8
• CVE-2026-493539Router is an AI router & token saver. In 0.4.45 and earlier…7.5