Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-88892— OpenPanel SSRF via Unguarded Importer File URL Fetch

Quick assessment

Affected
Openpanel-dev openpanel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenPanel 是一个数据分析平台。在所有已知版本中（截至本漏洞发布时尚无修复版本），其数据导入功能使用普通的 请求调用方提供的 URL，而未调用项目中已有的 SSRF 防护工具（ ）。 具体而言，在 中， 函数会直接对 发起 请求，而该字段仅通过 进行校验，因此诸如 或 之类的地址均可被接受。同时，共享的 工厂函数也为其他看似合理的提供者提供了相同的字段。 因此，任何已认证的organization成员——包括默认的 'member' 角色（该角色没有对应的 记录，而本应进行的访问级别检查会因 返回布尔值 而

CVSS 5.0 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88892

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenPanel SSRF via Unguarded Importer File URL Fetch
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPanel is an analytics platform. In all versions (no patched release available at time of publication), the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch() on config.fileUrl, which is validated only by z.string().url(), so values such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/ are accepted; the shared createFileImportConfig factory gives the plausible provider the same field. An authenticated organization member — including a default 'member' with no project_access rows, for whom the intended access-level check is skipped because getProjectAccess returns boolean true rather than a level object — can therefore make the server connect to any address reachable from it. The resulting HTTP status and status text are persisted as Import.errorMessage and returned by import.get to the same user, providing a scanning oracle for internal hosts, ports and paths; if an internal response parses as Umami CSV, its rows are ingested as events and become readable in the attacker's analytics views.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Openpanel-dev openpanel 0 ~ worker -

II. Public POCs for CVE-2026-88892

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88892

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-88892 (2)

Same Patch Batch · Openpanel-dev · 2026-09-10 · 4 CVEs total

CVE-2026-88890 8.5 HIGH OpenPanel SQL Injection via unvalidated profile filter column identifier
CVE-2026-88891 8.3 HIGH OpenPanel Read-Only Access Level Enforcement Bypass via Mutations
CVE-2026-88893 7.5 HIGH OpenPanel Unauthenticated Share Lookup Information Disclosure

IV. Related Vulnerabilities

Same product: openpanel
Same vendor: Openpanel-dev
Same weakness: CWE-918

V. Comments for CVE-2026-88892

No comments yet

Leave a comment