Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55374— canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

Quick assessment

Affected
jleehr canto-saas-api
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

canto-saas-api 是一个用于与 Canto SaaS API 进行交互的 PHP 库。在 3.0.0 版本之前，Request::buildRequestUrl() 方法在拼接 Request::getPathVariables() 返回的值时，未对各路径段进行编码，其中包括 GetContentDetailsRequest 所使用的 scheme（协议）和 contentId（内容 ID）值。当调用方应用传入未经信任的路径变量值时，路径遍历序列、查询分隔符或片段分隔符可能会在 AbstractEndp

CVSS 4.8 · Medium

Possible ATT&CK Techniques 1 AI

T1090 · Proxy

Affected Version Matrix 1

VendorProduct Version RangeStatus
jleehr canto-saas-api < 3.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55374

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Source: CVE Program / CVE List V5
Vulnerability Description
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application's privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jleehr canto-saas-api < 3.0.0 -

II. Public POCs for CVE-2026-55374

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55374

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55374 (1)

Vendor Pages for CVE-2026-55374 (1)

IV. Related Vulnerabilities

Same product: canto-saas-api
Same vendor: jleehr
Same weakness: CWE-74

V. Comments for CVE-2026-55374

No comments yet

Leave a comment