CVE-2026-41195CWE-918

mosparo: Rule package source URL stored SSRF enables internal HTTP probing

Medium · published May 12, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and does not restrict private or loopback destinations, this becomes a stored SSRF primitive that can be turned into an internal HTTP probing oracle. This vulnerability is fixed in 1.4.13.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-12T21:24Z
EPSS history
Timeline
  • 12 MAY 21:24Z
    mosparo: Rule package source URL stored SSRF enables internal HTTP probing
    cvelistv5