{"id":"CVE-2026-112299","kind":"vulnerability","aliases":["CVE-2026-112299"],"related":[],"title":"SMR: album website field enables server-side request forgery","description":"A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"The SMR game's album editor takes a Website value and fetches it from the server to check reachability, so a user can make the server request internal or arbitrary URLs. An attacker can use this to probe internal services from the server's network position.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","smr"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the deployment includes src/pages/Account/AlbumEditProcessor.php and whether isUrlReachable is present in it\n- Compare the deployed commit to `f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d`; the fix is in `cb402e7f4e70b617b59d8c55dbe926b951ceb4a8`","fix":"- Update SMR to a commit that includes patch `cb402e7f4e70b617b59d8c55dbe926b951ceb4a8`\n- The sources give no versions because the project uses rolling releases","status":"open","published_at":"2026-10-19T21:17:06+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:39:31+00:00","updated_at":"2026-10-25T04:39:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:39:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update SMR to a commit that includes patch `cb402e7f4e70b617b59d8c55dbe926b951ceb4a8`\n- The sources give no versions because the project uses rolling releases","reach":"internet","title":"SMR: album website field enables server-side request forgery","impact":"medium","summary":"The SMR game's album editor takes a Website value and fetches it from the server to check reachability, so a user can make the server request internal or arbitrary URLs. An attacker can use this to probe internal services from the server's network position.","category":"package","nicknames":[],"who_cares":["self-hosted","php","smr"],"confidence":0.6,"needs_auth":"yes","worst_case":"Server makes requests to internal network addresses on an attacker's behalf","analyst_note":"","how_to_check":"- Check whether the deployment includes src/pages/Account/AlbumEditProcessor.php and whether isUrlReachable is present in it\n- Compare the deployed commit to `f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d`; the fix is in `cb402e7f4e70b617b59d8c55dbe926b951ceb4a8`","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Teams that run a self-hosted instance of the smrealms SMR game built at or before commit f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d, where players can edit album website fields. Instances that do not expose the album editor or that run a later commit are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3509,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112299':13A,16A '-2026':12A,15A 'advis':156C 'affect':79C,143C,180C 'album':2A,27B,91C 'appli':152C 'arbitrari':52B 'argument':98C 'attack':55B,109C 'basi':131C 'call':150C 'cb402e7f4e70b617b59d8c55dbe926b951ceb4a8':151C 'check':40B 'compon':90C 'consequ':135C 'contact':164C 'continu':133C 'cve':11A,14A 'deliveri':134C 'detail':140C 'determin':72C 'disclos':119C 'earli':165C 'editor':28B 'either':142C 'enabl':5A 'ensur':132C 'execut':93C 'exploit':115C 'f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d':78C 'fetch':34B 'field':4A 'file':86C 'fix':176C 'forgeri':10A,107C 'function':82C 'game':25B 'host':21B 'intern':50B,61B 'issu':160C 'isurlreach':83C 'launch':112C 'lead':101C 'make':46B 'manipul':95C 'manner':171C 'may':110C,121C 'network':67B 'oper':126C 'packag':17B 'patch':148C,154C 'php':18B 'posit':68B 'probe':60B 'product':125C,181C 'profession':170C 'public':118C 'quick':173C 'reachabl':41B 'releas':130C,146C,174C 'remot':113C 'request':9A,49B,106C 'resolv':158C 'respond':166C 'roll':129C 'self':20B 'self-host':19B 'server':7A,38B,48B,65B,104C 'server-sid':6A,103C 'servic':62B 'side':8A,105C 'smr':1A,22B,24B,75C 'smrealm':74C 'src/pages/account/albumeditprocessor.php':87C 'take':29B 'updat':145C 'url':53B 'use':57B 'user':44B 'util':123C 'valu':32B 'vendor':162C 'version':139C,177C 'vulner':70C 'websit':3A,31B,92C,99C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted instance of the smrealms SMR game built at or before commit f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d, where players can edit album website fields. Instances that do not expose the album editor or that run a later commit are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112299","severity":null,"published_at":"2026-10-19T21:17:06+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}