CVE-2026-42141 - XIBO CMS SSRF

SSRF vulnerability in Xibo CMS (CVE-2026-42141)

Description

Server-Side Request Forgery (SSRF) vulnerability in Xibo CMS via the uploadUrl feature. This vulnerability was discovered during security research on Xibo CMS.

Impact

An authenticated user can force the server to make HTTP requests to internal resources.

Technical Details

• Endpoint: /library/uploadUrl
• Method: POST
• Vulnerable parameter: URL

Proof of Concept

Example request:

POST /library/uploadUrl HTTP/1.1

url=http://localhost

Mitigation

• Validate URLs
• Block internal IP ranges
• Upgrade to patched version

Timeline