{"id":"CVE-2026-125367","kind":"vulnerability","aliases":["CVE-2026-125367"],"related":[],"title":"Pico: signed-up users can make the server fetch internal URLs","description":"Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.","summary":"Pico, a multi-user platform, has a server-side request forgery flaw in its feeds service through version 4.1.2. A signed-up user can make the server fetch arbitrary URLs, including loopback, private-network and cloud metadata endpoints, and read the responses.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","pico","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed Pico version against the affected range through 4.1.2","fix":null,"status":"open","published_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:31+00:00","updated_at":"2026-11-10T00:30:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Pico: signed-up users can make the server fetch internal URLs","impact":"medium","summary":"Pico, a multi-user platform, has a server-side request forgery flaw in its feeds service through version 4.1.2. A signed-up user can make the server fetch arbitrary URLs, including loopback, private-network and cloud metadata endpoints, and read the responses.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pico","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server reads cloud metadata and internal services","analyst_note":"Confirm the fixed version and any setting to disable feeds from the linked GitHub patch and VulnCheck advisory.","how_to_check":"- Check the installed Pico version against the affected range through 4.1.2\n- Unknown whether the sources name a config setting that disables the feeds service","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams that self-host Pico and let users sign up can be exposed, because any registered user can trigger outbound fetches from the server. Installs with no open sign-up, or where the feeds service is not used, are less exposed. Sources do not state a fixed version; the linked patch page should be checked.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4621,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125367':15A,18A '-2026':14A,17A '4.1.2':44B,72C 'allow':86C 'arbitrari':55B,96C 'attack':103C 'cloud':63B,124C 'command':102C 'contain':73C 'cve':13A,16A 'digest':108C 'endpoint':65B,126C 'feed':40B,83C,107C 'fetch':10A,54B,95C,116C 'fetcher.parseurl':118C 'flaw':37B 'forgeri':36B,79C 'host':23B 'immedi':115C 'includ':57B 'intern':11A,111C 'list':110C 'loopback':58B,121C 'make':7A,51B,92C 'metadata':64B,125C 'multi':27B 'multi-us':26B 'network':61B 'pico':1A,20B,24B,70C 'platform':29B 'post':109C 'privat':60B 'private-network':59B 'reach':120C 'read':67B 'request':35B,78C 'respons':69B 'rfc1918':122C 'run':100C 'self':22B 'self-host':21B 'server':9A,33B,53B,76C,94C 'server-sid':32B,75C 'servic':41B,84C 'side':34B,77C 'sign':3A,47B,88C 'signed-up':2A,46B,87C 'ssh':101C 'trigger':114C 'upload':105C 'url':12A,56B,97C,112C 'user':5A,28B,49B,90C 'version':43B 'via':98C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Pico and let users sign up can be exposed, because any registered user can trigger outbound fetches from the server. Installs with no open sign-up, or where the feeds service is not used, are less exposed. Sources do not state a fixed version; the linked patch page should be checked.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","pico","selfhosted"],"campaign_type":null,"search_a":"'-125367':15A,18A '-2026':14A,17A 'cve':13A,16A 'fetch':10A 'intern':11A 'make':7A 'pico':1A 'server':9A 'sign':3A 'signed-up':2A 'url':12A 'user':5A","search_b":"'4.1.2':44B 'arbitrari':55B 'cloud':63B 'endpoint':65B 'feed':40B 'fetch':54B 'flaw':37B 'forgeri':36B 'host':23B 'includ':57B 'loopback':58B 'make':51B 'metadata':64B 'multi':27B 'multi-us':26B 'network':61B 'pico':20B,24B 'platform':29B 'privat':60B 'private-network':59B 'read':67B 'request':35B 'respons':69B 'self':22B 'self-host':21B 'server':33B,53B 'server-sid':32B 'servic':41B 'side':34B 'sign':47B 'signed-up':46B 'url':56B 'user':28B,49B 'version':43B","search_c":"'4.1.2':72C 'allow':86C 'arbitrari':96C 'attack':103C 'cloud':124C 'command':102C 'contain':73C 'digest':108C 'endpoint':126C 'feed':83C,107C 'fetch':95C,116C 'fetcher.parseurl':118C 'forgeri':79C 'immedi':115C 'intern':111C 'list':110C 'loopback':121C 'make':92C 'metadata':125C 'pico':70C 'post':109C 'reach':120C 'request':78C 'rfc1918':122C 'run':100C 'server':76C,94C 'server-sid':75C 'servic':84C 'side':77C 'sign':88C 'signed-up':87C 'ssh':101C 'trigger':114C 'upload':105C 'url':97C,112C 'user':90C 'via':98C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125367","severity":null,"published_at":"2026-11-10T00:17:08+00:00","modified_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111513,"url":"https://github.com/picosh/pico/commit/48a85d6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111514,"url":"https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}