Live › vulnerability › CVE-2026-112299
Go to dashboardThe SMR game's album editor takes a Website value and fetches it from the server to check reachability, so a user can make the server request internal or arbitrary URLs. An attacker can use this to probe internal services from the server's network position.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run a self-hosted instance of the smrealms SMR game built at or before commit f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d, where players can edit album website fields. Instances that do not expose the album editor or that run a later commit are not affected.
No product ranges from the sources yet.
f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d; the fix is in cb402e7f4e70b617b59d8c55dbe926b951ceb4a8cb402e7f4e70b617b59d8c55dbe926b951ceb4a8Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-112299")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.