Live › vulnerability › CVE-2026-55190
Go to dashboardEvent Schedule versions 1.0.0 and earlier have an SSRF guard on user-supplied import URLs that can be bypassed in two ways. An attacker can make the server fetch localhost or internal services and import the response as events.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Event Schedule 1.0.0 or earlier that expose the URL-based event import to users. Deployments that do not use the curator import feature, or that restrict who can trigger imports, are less exposed. Egress filtering to internal networks reduces what an attacker can reach.
No product ranges from the sources yet.
1.0.0 and earlierApp\Utils\UrlUtils::isUrlSafe() check and the ImportCuratorEvents import path in the codebaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and file_get_contents($ogImage)). At time of publication, there are no publicly available patches.
This page as .md · .json · in your agent: get_signal("CVE-2026-55190")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.