CVE-2026-92931 PUBLISHED

CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

Assigner: ProgressSoftware
Reserved: 17.09.2026 Published: 05.10.2026 Updated: 05.10.2026

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Progress Software
Product	@progress/sitefinity-nextjs-sdk
Versions	Default: unaffected affected from 15.1.8326 to 15.4.8638 (excl.)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz) finder

References

https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026

Problem Types

CWE-918: Server-Side Request Forgery CWE

Impacts

CAPEC-664: Server Side Request Forgery