CVE-2026-54546

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/routes/basemap.ts to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure. This issue is fixed in version 13.22.1.

• CWE-918

• https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c
• https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf
• https://github.com/dfpc-coe/CloudTAK/pull/1513
• https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1
• https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v
• https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54540Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-54541Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…3.7
• CVE-2026-54542Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…3.7
• CVE-2026-54543Froxlor is open source server administration software. Prior…5.4
• CVE-2026-54544Fireshare facilitates self-hosted media and link sharing. Pr…7.2
• CVE-2026-54545wakaru is a JavaScript decompiler and unminifier toolkit. Fr…7.1
• CVE-2026-54547Meta Ads MCP is a Model Context Protocol (MCP) server that l…7.4
• CVE-2026-54548kas is a setup tool for bitbake based projects. Prior to 5.4…3.3
• CVE-2026-54549Meta Ads MCP is a Model Context Protocol (MCP) server that l…8.3
• CVE-2026-5455A vulnerability was determined in Dialogue App up to 4.3.2 o…3.3
• CVE-2026-54550IzPack is a widely used tool for packaging applications on t…7.4
• CVE-2026-54551WireGuard Portal, or wg-portal, is a web-based configuration…4.3