Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61529— Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Quick assessment

Affected
endatix endatix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Endatix 是一个支持自托管的表单与调查管理平台，提供无头（headless）API。在 0.7.0 版本之前，匿名访问的 端点在仅验证 JSON 格式正确后，便会存储由攻击者控制的 。其中，包含 、 和 字段的文件对象可携带 HTTP 或 HTTPS URL。当拥有 权限的工作人员调用 端点时， 会将已存储的数据传递给位于 中的 。该组件随后调用 ，却未对目标 URL、主机或解析后的 IP 地址进行任何内部地址范围校验。这导致攻击者可利用已存储的数据，发起面向服务器内部服务、云元数据端点、回环地址（loopb

CVSS 4.7 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61529

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
Source: CVE Program / CVE List V5
Vulnerability Description
Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object with `name`, `type` and `content` fields can contain an HTTP or HTTPS URL. When a staff member with `submissions.view` permission invokes `POST /forms/{formId}/submissions/{submissionId}/files`, `GetFilesHandler` passes the stored data to `SubmissionFileExtractor` in `src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs`, which calls `HttpClient.GetAsync` without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services, cloud metadata, loopback and link-local addresses from the server's network position. The form must have `IsPublic` and `IsEnabled` set, and an anonymous submission must pass reCAPTCHA v3 when configured. The fetched response is placed in the staff viewer's ZIP, not returned directly to the attacker, so disclosure to the attacker is blind or indirect through observable request behavior or information exposed by the viewer. No integrity or availability impact is asserted; data: and raw-base64 `content` are decoded locally without network requests. This issue is fixed in version 0.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
endatix endatix < 0.7.0 -

II. Public POCs for CVE-2026-61529

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61529

请登录查看更多情报信息。

Other References for CVE-2026-61529 (4)

IV. Related Vulnerabilities

Same weakness: CWE-918