What’s Vulnerable › Vulnerabilities

CVE-2026-41177: Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-06-17
• Weakness: CWE-73

Description

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied `Url` parameter, allowing the use of the `file://` protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.

Affected products

• squidex: before 7.23.0

References

• https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4
• https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5
• https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5

Get alerted when CVE-2026-41177 or the next vulnerability affects your stack