CVE-2026-110628— Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

一分钟漏洞结论

复制摘要 复制引用

影响对象

kanbn kan

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fe

CVE-2026-110628 影响 kanbn kan。尚无明确在野利用证据，仍需结合暴露面评估。Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. Wh CVE-2026-110628 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-110628

一、 漏洞 CVE-2026-110628 基础信息

受影响产品

二、漏洞 CVE-2026-110628 的公开POC

三、漏洞 CVE-2026-110628 的情报信息

CVE-2026-110628 补丁与修复 (1)

• feat: add url validation to download attatchment endpoint (#432) · kanbn/kan@53397d8 · GitHub patch

CVE-2026-110628 厂商安全公告 (1)

• Unauthenticated SSRF in attachment download endpoint · Advisory · kanbn/kan · GitHub vendor-advisory

CVE-2026-110628 其他参考 (5)

• https://hackmd.io/@leediay/HyIxU63ofg third-party-advisory
• https://github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27 technical-description
• https://github.com/kanbn/kan/pull/590 issue-tracking patch
• https://github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52 technical-description
• https://www.vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchment third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-110628

IV. Related Vulnerabilities

V. Comments for CVE-2026-110628