As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
Apache Fesod (Incubating) version 2.0.2-incubating contains a server-side request forgery (SSRF) vulnerability in the UrlImageConverter component that can be bypassed through DNS rebinding attacks. An attacker who controls the image URL passed to the spreadsheet writer can circumvent hostname validation and IP address checks to reach unintended destinations.
Why it matters: Applications using Fesod 2.0.2-incubating to process user-supplied image URLs in spreadsheets can be exploited to access internal services, making immediate patching or URL validation hardening necessary for deployments in restricted network environments.
- Source published
- First seen by Cybersecurity Tracker