CVE-2026-18359 PUBLISHED

Server-Side Request Forgery (SSRF) in eScriptorium

Assigner: GitLab
Reserved: 30.07.2026 Published: 06.08.2026 Updated: 06.08.2026

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS Score: 8.5

Product Status

Vendor Scripta
Product eScriptorium
Versions Default: unaffected
  • affected from 0 to 26.4.1 (incl.)

Solutions

Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9. As a mitigation on affected versions, set the IMPORT_ALLOWED_DOMAINS setting to an explicit list of permitted domains instead of leaving it at its default value of '*'.

Credits

  • Thibault Clérice & Hassen Aguili finder

References

Problem Types

  • CWE-918: Server-Side Request Forgery (SSRF) CWE