CVE-2026-116224— fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery

Quick assessment

Affected

fr0tt benotes

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 fr0tt benotes 2.8.1 及以下版本中发现了一个漏洞。该漏洞影响组件“书签元数据端点”中文件的函数。攻击者通过操纵参数可触发服务器端请求伪造（SSRF）。该攻击可远程发起。利用方式已公开披露，可能被利用。项目方已通过问题报告较早获知此问题，但尚未作出回应。

CVSS 4.3 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1091 · Replication Through Removable Media

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
fr0tt	benotes	2.8.0	`cpe:2.3:a:fr0tt:benotes::::::::`

II. Public POCs for CVE-2026-116224

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116224

请登录查看更多情报信息。

Other References for CVE-2026-116224 (8)

https://github.com/fr0tt/benotes/issues/116 issue-tracking
https://gist.github.com/qianqiusujiu/58f979be4c9bbd1cf2864d85e79603d8 exploit
https://github.com/fr0tt/benotes/ product
https://vuldb.com/cve/CVE-2026-116224 third-party-advisory
https://vuldb.com/vuln/426204/cti signature permissions-required
https://vuldb.com/vuln/426204 vdb-entry technical-description
https://vuldb.com/submit/1005024 third-party-advisory
https://vuldb.com/submit/1009911 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116224

IV. Related Vulnerabilities

Same weakness: CWE-918