{"id":"CVE-2026-55190","kind":"vulnerability","aliases":["CVE-2026-55190"],"related":[],"title":"Event Schedule: SSRF guard bypass lets imports reach internal services","description":"Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\\Utils\\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and file_get_contents($ogImage)). At time of publication, there are no publicly available patches.","summary":"Event Schedule versions 1.0.0 and earlier have an SSRF guard on user-supplied import URLs that can be bypassed in two ways. An attacker can make the server fetch localhost or internal services and import the response as events.","severity":"medium","cvss":6.5,"epss":0.00361,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-schedule","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Event Schedule version against `1.0.0` and earlier\n- Look for the `App\\Utils\\UrlUtils::isUrlSafe()` check and the `ImportCuratorEvents` import path in the codebase\n- Review whether the import feature is reachable by untrusted users","fix":"- No patch was publicly available at publication; unknown whether a fixed version exists\n- Restrict or disable the curator event import feature until a fix is released\n- Block outbound requests from the app server to internal and localhost addresses at the network layer","status":"open","published_at":"2026-10-23T13:17:09+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:47:17+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:17Z","model":"claude-haiku-5-5","output":{"fix":"- No patch was publicly available at publication; unknown whether a fixed version exists\n- Restrict or disable the curator event import feature until a fix is released\n- Block outbound requests from the app server to internal and localhost addresses at the network layer","reach":"internet","title":"Event Schedule: SSRF guard bypass lets imports reach internal services","impact":"medium","summary":"Event Schedule versions 1.0.0 and earlier have an SSRF guard on user-supplied import URLs that can be bypassed in two ways. An attacker can make the server fetch localhost or internal services and import the response as events.","category":"package","nicknames":[],"who_cares":["event-schedule","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads internal and localhost services through the server's fetches","analyst_note":"Confirm whether the import feature requires login and whether a fixed version is released; check the NVD entry for the exact affected versions and the bypass details.","how_to_check":"- Check the installed Event Schedule version against `1.0.0` and earlier\n- Look for the `App\\Utils\\UrlUtils::isUrlSafe()` check and the `ImportCuratorEvents` import path in the codebase\n- Review whether the import feature is reachable by untrusted users","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running Event Schedule 1.0.0 or earlier that expose the URL-based event import to users. Deployments that do not use the curator import feature, or that restrict who can trigger imports, are less exposed. Egress filtering to internal networks reduces what an attacker can reach.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3387,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-55190':13A,16A '1.0.0':28B,84C 'app':87C 'appli':95C 'attack':49B 'avail':146C 'bodi':126C 'bring':79C 'bypass':5A,44B,105C 'communiti':80C 'content':136C 'cve':11A,14A 'earlier':30B 'event':1A,18B,25B,64B,65C,75C,132C 'event-schedul':17B 'fetch':54B,117C 'file':134C 'get':121C,135C 'guard':4A,34B,94C 'host':24B 'http':120C 'import':7A,39B,60B,100C,130C 'importcuratorev':119C 'intern':9A,57B 'internal/localhost':110C 'isurlsaf':90C 'later':116C 'let':6A 'localhost':55B 'make':51B 'ogimag':137C 'open':70C 'open-sourc':69C 'packag':20B 'pars':128C 'patch':147C 'php':21B 'platform':72C 'prior':86C 'public':141C,145C 'reach':8A,109C 'respons':62B,125C 'schedul':2A,19B,26B,66C 'self':23B 'self-host':22B 'sell':76C 'server':53B 'servic':10A,58B,111C 'share':74C 'sourc':71C 'ssrf':3A,33B,93C 'suppli':38B,99C 'ticket':77C 'time':139C 'togeth':81C 'two':46B,106C 'url':40B,101C,114C,122C 'urlutil':89C 'user':37B,98C 'user-suppli':36B,97C 'util':88C 'version':27B,83C 'way':47B,107C","nicknames":[],"mitigations":[],"who_affected":"Sites running Event Schedule 1.0.0 or earlier that expose the URL-based event import to users. Deployments that do not use the curator import feature, or that restrict who can trigger imports, are less exposed. Egress filtering to internal networks reduces what an attacker can reach.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55190","severity":null,"published_at":"2026-10-23T13:17:09+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-55190","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55190","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}