Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112991— MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

Quick assessment

Affected
MISP MISP Modules
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP Modules 中的 扩展模块在其 URL 验证函数中存在服务器端请求伪造（SSRF）漏洞。用于拒绝不安全目标地址的 列表不完整，遗漏了若干关键 IP 地址段。具体而言，以下地址段未被拦截： （未指定地址，在 Linux 系统中会路由到回环接口）； （运营商级 NAT，依据 RFC 6598）； （IPv6 未指定地址）； （IPv6 唯一本地地址）； （IPv6 链路本地地址）。 现有的拦截列表仅覆盖了 IPv4 回环地址（ ）、RFC 1918 定义的私有地址段、IPv4 链路本地地址（ ）以及 IP

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112991

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
Source: CVE Program / CVE List V5
Vulnerability Description
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128). An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks. The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP Modules 0 ~ 3.0.12 cpe:2.3:a:misp:misp_modules_\(html_to_markdown_expansion_module\):*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112991

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112991

请登录查看更多情报信息。

Other References for CVE-2026-112991 (1)

Same Patch Batch · MISP · 2026-10-19 · 8 CVEs total

CVE-2026-112178 7.1 HIGH MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access C
CVE-2026-112188 7.1 HIGH MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutio
CVE-2026-112179 5.3 MEDIUM MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-112192 5.3 MEDIUM MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Setting
CVE-2026-112180 5.1 MEDIUM MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-112184 4.8 MEDIUM MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab
CVE-2026-112183 4.8 MEDIUM MISP CSS Injection via Remote Tag Colour in Event Preview

IV. Related Vulnerabilities

Same vendor: MISP
Same weakness: CWE-918

V. Comments for CVE-2026-112991

No comments yet

Leave a comment