CVE-2026-54166

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted `fetch()` request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.

• CWE-918

• https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-xgrm-8w6v-mvjg

Published

Sep 11, 2026

Last Modified

Sep 14, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54158SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-54159PrestaShop ps_facetedsearch is a module that adds layered na…10
• CVE-2026-5416Due to the improper neutralization of special elements used …8.8
• CVE-2026-54163secure_headers manages application of security headers with …4.7
• CVE-2026-54164API Platform Core is a system to create hypermedia-driven RE…6.5
• CVE-2026-54165Dobase is an open-source, self-hosted workspace with install…6.4
• CVE-2026-54167Pipelines-as-Code is a CI/CD system that lets users define T…8.2
• CVE-2026-54168Pipelines-as-Code is a CI/CD system that lets users define T…6.5
• CVE-2026-5417A vulnerability was determined in Dataease SQLbot up to 1.6.…4.7
• CVE-2026-54171Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.…6.5
• CVE-2026-54174melange allows users to build apk packages using declarative…8.3
• CVE-2026-54175backpack/crud provides Create, Read, Update & Delete (CRUD) …7.6