Live › vulnerability › CVE-2026-101300
Go to dashboardThe Wegow ticket sales chart PDF export accepts an attacker-controlled svg parameter that is sent to the export.highcharts.com service, which fetches external URLs and embeds the responses in the PDF. An authenticated promoter can use the export service as a proxy to reach attacker-chosen resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Wegow Technologies' hosted backoffice is concerned (ticket sales chart PDF export, backoffice.wegow.com). An attacker needs a promoter account; they can alter the svg parameter so the Highcharts export service (export.highcharts.com) requests attacker-chosen URLs and embeds the responses in the PDF. Wegow customers and promoters have nothing to patch themselves; everyone else can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Wegow | vendor | unknown (vendor says only actual version) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-101300")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.