CVE-2026-41177
Squidex is an open source headless content management system and content management hub.
Published Apr 22, 2026 · updated Jun 17, 2026
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied parameter, allowing the use of the protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 22, 2026 · NIST NVD
Detected
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied parameter, allowing the use of the protocol. This allows an authenticated administrator to force the backend server to interact with
Jun 17, 2026 · NIST NVD
Updated
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied parameter, allowing the use of the protocol. This allows an authenticated administrator to force the backend server to interact with
Sources
- CVE.orgVulnerability recordCVE-2026-41177
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41177
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied paramet
nvd.nist.gov