Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107460— Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

Quick assessment

Affected
Apache Software Foundation Apache Fesod (Incubating)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Fesod（Incubating）fesod-sheet 2.0.2-incubating 版本中 UrlImageConverter 组件的服务器端请求伪造（SSRF）防护机制可通过 DNS 重绑定攻击被绕过。当应用程序接受由攻击者控制的图像 URL 用于电子表格写入时，转换器首先检查该主机名解析出的 IP 地址，随后会建立一个新连接，并在此新连接中再次解析该主机名。如果攻击者能够控制该 URL 主机名的 DNS 响应，便可能在通过验证后使连接指向受限的内部地址。CVE-2026-49328 涵盖的

AI Predicted 6.5 Difficulty: Moderate

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Fesod (Incubating) 2.0.2-incubating affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107460

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Fesod (Incubating) 2.0.2-incubating -

II. Public POCs for CVE-2026-107460

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107460

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-107460 (1)

Vendor Advisories for CVE-2026-107460 (1)

Mailing List Discussions for CVE-2026-107460 (1)

Vendor Pages for CVE-2026-107460 (1)

IV. Related Vulnerabilities

Same product: Apache Fesod (Incubating)
Same vendor: Apache Software Foundation
Same weakness: CWE-918

V. Comments for CVE-2026-107460

No comments yet

Leave a comment