Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Webstudio can be tricked to expose internal network information

CVE-2026-86119 · published 1 month ago
Summary

The Webstudio application (versions up to 0.296.0) lets anyone send a specially crafted request to its image, video or asset endpoints and make the server contact any URL they choose. This can reveal the server’s internal IP addresses, cloud metadata and other private services. Update to a patched version or disable those proxy routes until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webstudio-is webstudio <= 0.296.0
Original advisory text
Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Sep 2026
Updated15 Oct 2026
First seen5 Sep 2026
Sources
CVE-2026-86119 · NVD
CVE-2026-86119 · MITRE
CVE-2026-86119 · OSV
Track software like this
Free during beta