CVE-2026-121581— ArcReel Provider Test-Connection Endpoint test server-side request forgery

Quick assessment

Affected

n/a ArcReel

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ArcReel 0.32.0、0.33.0 和 0.34.0 版本中发现了一个漏洞。受影响的组件是 Provider Test-Connection Endpoint 中的文件，具体涉及该文件中的某个未知函数。攻击者通过操纵该函数可触发服务器端请求伪造（SSRF）漏洞，且该漏洞可被远程利用。目前该漏洞的利用方法已向公众公开，可能被恶意使用。尽管厂商已在漏洞披露初期被联系，但至今未作出任何回应。

CVSS 4.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ArcReel Provider Test-Connection Endpoint test server-side request forgery

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	ArcReel	0.32.0	`cpe:2.3:a:arcreel:arcreel::::::::`

II. Public POCs for CVE-2026-121581

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121581

请登录查看更多情报信息。

Other References for CVE-2026-121581 (8)

https://github.com/waterhunter2000-svg/vulnerability-reports related
https://github.com/ArcReel/ArcReel/ product
https://github.com/ArcReel/ArcReel/security/advisories/GHSA-hrr6-72vw-wgx5 broken-link
https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/06-arcreel-provider-test-ssrf.md exploit
https://vuldb.com/cve/CVE-2026-121581 third-party-advisory
https://vuldb.com/vuln/430416/cti signature permissions-required
https://vuldb.com/submit/1019997 third-party-advisory
https://vuldb.com/vuln/430416 vdb-entry

https://www.cve.org/CVERecord?id=CVE-2026-121581

Same Patch Batch · n/a · 2026-11-03 · 9 CVEs total

CVE-2026-106991	7.1 HIGH	HustOJ 24.09.10-26.08.19 任意用户操作漏洞
CVE-2026-121582	6.5 MEDIUM	Umami Record API Endpoint route.ts authorization
CVE-2026-121531	6.3 MEDIUM	Umami 2FA Policy route.ts single-factor authentication
CVE-2026-121509	5.3 MEDIUM	Headless CMS Plugin REST API post get_required_post_data information disclosure
CVE-2026-121517	5.0 MEDIUM	IrfanView TIFF Wang Annotation heap-based overflow
CVE-2026-38595		im3x Scriptables v2-dev 任意文件上传命令注入漏洞
CVE-2026-38600		codeskyblue gohttpserver v1.3.0 存在 Zip Slip 漏洞
CVE-2026-38601		codeskyblue v1.3.0 硬编码密钥导致身份伪造漏洞

IV. Related Vulnerabilities

Same vendor: n/a

Same weakness: CWE-918