CVE-2026-100355— Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard

Quick assessment

Affected

basecamp once-campfire

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Campfire 是一款基于 Web 的聊天应用。在 1.4.4 及更早版本中，当 Campfire 消息包含链接时，服务器会获取该链接以生成 OpenGraph 展开预览。依赖于 Ruby 的、和谓词，以及针对 IPv4 映射地址和 IPv4 兼容地址的检查；然而，这些检查未能涵盖若干特殊用途地址范围。因此，已认证用户可发布指向解析到 CGNAT（100.64.0.0/10）、NAT64（64:ff9b::/96 或 64:ff9b:1::/48）或 6to4（2002::/16）地址的主名的链接，从而绕

CVSS 3.1 · Low Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1091 · Replication Through Removable Media T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard

Source: CVE Program / CVE List V5

Vulnerability Description

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
basecamp	once-campfire	< 1.4.5	-

II. Public POCs for CVE-2026-100355

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-100355

请登录查看更多情报信息。

Other References for CVE-2026-100355 (4)

https://github.com/basecamp/once-campfire/pull/225 x_refsource_MISC
https://github.com/basecamp/once-campfire/releases/tag/v1.4.5 x_refsource_MISC
https://github.com/basecamp/once-campfire/security/advisories/GHSA-gjm7-g266-w3wj x_refsource_CONFIRM
https://github.com/basecamp/once-campfire/commit/69e8cd788593cf421c32626a5273c0b449ceee9b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-100355

IV. Related Vulnerabilities

Same vendor: basecamp

Same weakness: CWE-918