Live › vulnerability › CVE-2026-61529
Go to dashboardEndatix stores anonymous form submissions with file objects that can contain URLs, and later fetches those URLs from the server when a staff member downloads the files. An attacker can make the server send GET requests to internal services, cloud metadata endpoints, and loopback addresses, with the response only visible to staff in a ZIP file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Self-hosted Endatix instances below 0.7.0 that have public forms accepting anonymous submissions with file fields. The exposure depends on the server's network position, since the requests originate from the server and can reach whatever it can reach internally. Instances on 0.7.0 or later, or with no public forms, can skip it.
No product ranges from the sources yet.
0.7.0IsPublic and IsEnabled set that accept anonymous submissionsPOST /forms/{formId}/submissions/{submissionId}/files calls0.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/{formId}/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contain an HTTP or HTTPS URL. When a staff member with submissions.view permission invokes POST /forms/{formId}/submissions/{submissionId}/files, GetFilesHandler passes the stored data to SubmissionFileExtractor in src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs, which calls HttpClient.GetAsync without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services, cloud metadata, loopback and link-local addresses from the server's network position. The form must have IsPublic and IsEnabled set, and an anonymous submission must pass reCAPTCHA v3 when configured. The fetched response is placed in the staff viewer's ZIP, not returned directly to the attacker, so disclosure to the attacker is blind or indirect through observable request behavior or information exposed by the viewer. No integrity or availability impact is asserted; data: and raw-base64 content are decoded locally without network requests. This issue is fixed in version 0.7.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-61529")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.