CVE-2026-88892

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch() on config.fileUrl, which is validated only by z.string().url(), so values such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/ are accepted; the shared createFileImportConfig factory gives the plausible provider the same field. An authenticated organization member — including a default 'member' with no project_access rows, for whom the intended access-level check is skipped because getProjectAccess returns boolean true rather than a level object — can therefore make the server connect to any address reachable from it. The resulting HTTP status and status text are persisted as Import.errorMessage and returned by import.get to the same user, providing a scanning oracle for internal hosts, ports and paths; if an internal response parses as Umami CSV, its rows are ingested as events and become readable in the attacker's analytics views.

• CWE-918

• https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83
• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cj2r-3x54-88h7
• https://www.vulncheck.com/advisories/openpanel-ssrf-via-unguarded-importer-file-url-fetch
• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cj2r-3x54-88h7

Published

Sep 10, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88887Renovate is a dependency update automation tool. When listin…8.6
• CVE-2026-88888Renovate before 44.14.7 contains a command injection vulnera…7
• CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8
• CVE-2026-8889Version 3.0.7 of the Securly Chrome Extension uses deprecate…7.5
• CVE-2026-88890OpenPanel through 2.3.0 contains an SQL injection vulnerabil…8.5
• CVE-2026-88891OpenPanel through 2.3.0 fails to enforce read-only project a…8.3
• CVE-2026-88893OpenPanel through 2.3.0 share lookup procedures fail to vali…7.5
• CVE-2026-88894Snipe-IT's predefined kit checkout path does not enforce Ful…5.4
• CVE-2026-88895CyberPanel before 3.0.5 fails to enforce two-factor authenti…7.2
• CVE-2026-88896EspoCRM before 10.0.4 is vulnerable to server-side request f…5.3
• CVE-2026-88897Flextype CMS through 1.0.0-alpha.3 accepts API authenticatio…5.9
• CVE-2026-88898AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authori…6.5