CVE-2026-59095 | BDVDB-2026-345348 Detail

Description#

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-02Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.