CVE-2026-92931 — CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

CVE-2026-92931

CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK PUBLISHED

Description (CNA)

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

Affected (CNA)

Vendor / product	Versions
Progress Software / @progress/sitefinity-nextjs-sdk	affected 15.1.8326 before 15.4.8638

CWE

CWE-918

References

https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.