CVE-2026-41177CWE-73CWE-918

Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction

Medium · published April 22, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI scheme of the user-supplied `Url` parameter, allowing the use of the `file://` protocol. This allows an authenticated administrator to force the backend server to interact with the local filesystem, which can lead to Local File Interaction (LFI) and potential disclosure of sensitive system information through side-channel analysis of internal logs. Version 7.23.0 contains a fix.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00426 · 35.8th percentile
Weaknesses
CWE-73 · External Control of File Name or Path; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-22T21:24Z
EPSS history
Timeline
  • 22 APR 21:24Z
    Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction
    cvelistv5