Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116680— Homebox generic notifier SSRF via HTTP redirect after URL validation

Quick assessment

Affected
sysadminsmedia homebox
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HomeBox 是一款家庭资产清单与管理系统。在 0.27.0 版本之前，HomeBox 会在创建、更新、测试以及计划发送通知器时，先通过 ValidateNotifierURL 对通用通知器 URL 进行验证；然而，shoutrrr 在发送请求时使用的是 http.DefaultClient.Do，且未配置 CheckRedirect 策略来对每个 Location 目标重新验证。因此，已认证的集合成员可以配置一个允许的通知器主机，使其重定向到回环地址、链路本地地址、云元数据端点或其他被禁止的目标，从而导致后续请

CVSS 6.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
sysadminsmedia homebox < 0.27.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116680

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Homebox generic notifier SSRF via HTTP redirect after URL validation
Source: CVE Program / CVE List V5
Vulnerability Description
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sysadminsmedia homebox < 0.27.0 -

II. Public POCs for CVE-2026-116680

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116680

请登录查看更多情报信息。

Other References for CVE-2026-116680 (3)

IV. Related Vulnerabilities

Same product: homebox
Same vendor: sysadminsmedia
Same weakness: CWE-918