CVE-2021-22255

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-20 · updated 2026-06-17
Weakness: CWE-918

Description

SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address.

Affected products

Baserow: from 0.6.0 before 1.1.0 — fixed in 1.1.0

How to fix

Upgrade to a fixed version: Baserow 1.1.0. Check the vendor advisory for mitigations.

References

https://baserow.io/blog/march-2021-release-of-baserow
https://gitlab.com/bramw/baserow/-/issues/370
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22255.json
https://baserow.io/blog/march-2021-release-of-baserow
https://gitlab.com/bramw/baserow/-/issues/370
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22255.json

Get alerted when CVE-2021-22255 or the next vulnerability affects your stack