Live › vulnerability › CVE-2026-111720
Go to dashboardfish-island-backend through commit 7c61b78 has an unauthenticated server-side request forgery in GET /api/web/parse, where the url parameter makes the server fetch attacker-chosen URLs. An attacker can reach internal hosts, loopback services and cloud metadata endpoints and read back page titles, meta descriptions and favicons.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running fish-island-backend at or before commit 7c61b78 where the /api/web/parse endpoint is reachable by untrusted clients. Deployments that keep the service off public networks or block outbound requests from it reduce the reach, but the sources do not name a patched version.
No product ranges from the sources yet.
7c61b78 or earlier./api/web/parse route in the running service and whether it is reachable from outside the network.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
This page as .md · .json · in your agent: get_signal("CVE-2026-111720")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.