← CVE Intelligence

CVE-2026-18359

Server-Side Request Forgery (SSRF) in eScriptorium PUBLISHED

Description (CNA)

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied

Affected (CNA)

Vendor / productVersions
Scripta / eScriptoriumaffected 0 through 26.4.1

CWE

CWE-918

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.