CVE-2021-26699

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-22 · updated 2026-06-17
Weakness: CWE-918

Description

OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.

Affected products

Open-Xchange Appsuite: 7.10.3, 7.10.3-patch_release5547, 7.10.3-patch_release5572, 7.10.3-patch_release5623, 7.10.3-patch_release5653, 7.10.3-patch_release5677 (+50)

References

http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2021/Jul/33
https://seclists.org/fulldisclosure/2021/Jul/33
https://www.open-xchange.com
http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2021/Jul/33
https://seclists.org/fulldisclosure/2021/Jul/33
https://www.open-xchange.com

Get alerted when CVE-2021-26699 or the next vulnerability affects your stack