Live › vulnerability › CVE-2026-116224
Go to dashboardThe getUrlInfo function in benotes (up to 2.8.1) fetches a URL supplied by the user without restricting the target. A remote attacker can make the server send requests to internal addresses on its behalf.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Teams that self-host benotes up to version 2.8.1 and expose the bookmark metadata endpoint are exposed. Servers on a private network with internal services reachable from the app are the most at risk. Teams on a version later than 2.8.1 or without this endpoint can skip it.
No product ranges from the sources yet.
2.8.1 are affected.app/Http/Controllers/PostController.php for the getUrlInfo function and whether it validates the url argument.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116224")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.