Content of external URL mails, their stylesheets and images to embed is fetched by the server...
0.69github-advisories · v1 · published 11/3/2026, 12:31:48 PM · modified 11/3/2026, 12:31:53 PM · TLP:CLEAR
offsec.vulnerability
Source evidence ↗Entities
cwe: CWE-918ghsa: GHSA-fr59-cpw2-mg8rcve: CVE-2026-120331
Assessment
Fact summary
low · heuristicContent of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
Technical delta
low · heuristicAutomated delta unavailable (heuristic mode).
Defensive significance
low · heuristicNone identified (heuristic mode).
Extracted text
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.