CVE-2026-55421— Open edX Platform: SSRF in Studio Video Download Endpoint
Quick assessment
Affected
openedx openedx-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open edX 平台支持在线学习内容的创作与分发，适用于任意规模。在提交 00b7c3c 之前，该端点接受用户提供的 ，并使用 在服务器端发起 HTTP GET 请求获取文件内容。获取到的字节数据随后被封装进 ZIP 响应中返回。这使得攻击者可以实施服务端请求伪造（SSRF）并外泄响应数据：由于启用了重定向跟随（allow_redirects=True），且该漏洞路径中的请求未设置超时时间，攻击者可借此向外部服务器发起请求并读取返回内容，从而将信息泄露给攻击者。 该漏洞已在提交 00b7c3c 中修复。
Possible ATT&CK Techniques 2 AI
T1041 · Exfiltration Over C2 Channel T1071 · Application Layer Protocol
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55421
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open edX Platform: SSRF in Studio Video Download Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openedx | openedx-platform | < 00b7c3ce418b487c5696b064fc5033594b045e75 | - |
|
II. Public POCs for CVE-2026-55421
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55421
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55421 (3)
Vendor Advisories for CVE-2026-55421 (1)
Same Patch Batch · openedx · 2026-09-02 · 3 CVEs total
| CVE-2026-53635 | 7.6 HIGH | Open edX Platform: Insufficient Permission on set_course_mode_price() |
| CVE-2026-53636 | 4.7 MEDIUM | Open edX LTI OAuth Replay Attack |
IV. Related Vulnerabilities
Same product: openedx-platform
-
CVE-2026-53636
Open edX LTI OAuth Replay Attack -
CVE-2026-53635
Open edX Platform: Insufficient Permission on set_course_mod -
CVE-2026-42857
Open edX Platform: Stored CSS Injection in Email Notificatio -
CVE-2026-42858
Open edX Platform: Server-Side Request Forgery (SSRF) in SAM -
CVE-2026-35404
Open edX Platform has an Open Redirect in Survey Views via U
Same vendor: openedx
-
CVE-2026-53636
Open edX LTI OAuth Replay Attack -
CVE-2026-53635
Open edX Platform: Insufficient Permission on set_course_mod -
CVE-2026-42860
Open edx Enterprise Service: SSRF via SAML metadata URL in s -
CVE-2026-42857
Open edX Platform: Stored CSS Injection in Email Notificatio -
CVE-2026-42858
Open edX Platform: Server-Side Request Forgery (SSRF) in SAM
Same weakness: CWE-918
-
CVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltra -
CVE-2026-66842
BIG-IP and BIG-IQ Configuration utility vulnerability -
CVE-2026-73474
Entity Share Websub - Moderately critical - Server-side requ -
CVE-2026-84772
WordPress Broken Link Checker plugin <= 2.4.14 - Server Side -
CVE-2026-84175
Eclipse Ditto 3.0.0至3.9.6 服务器端请求伪造漏洞
V. Comments for CVE-2026-55421
No comments yet