{"id":"CVE-2026-61529","kind":"vulnerability","aliases":["CVE-2026-61529"],"related":[],"title":"Endatix: stored submission file URLs let staff trigger server-side requests","description":"Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object with `name`, `type` and `content` fields can contain an HTTP or HTTPS URL. When a staff member with `submissions.view` permission invokes `POST /forms/{formId}/submissions/{submissionId}/files`, `GetFilesHandler` passes the stored data to `SubmissionFileExtractor` in `src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs`, which calls `HttpClient.GetAsync` without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services, cloud metadata, loopback and link-local addresses from the server's network position. The form must have `IsPublic` and `IsEnabled` set, and an anonymous submission must pass reCAPTCHA v3 when configured. The fetched response is placed in the staff viewer's ZIP, not returned directly to the attacker, so disclosure to the attacker is blind or indirect through observable request behavior or information exposed by the viewer. No integrity or availability impact is asserted; data: and raw-base64 `content` are decoded locally without network requests. This issue is fixed in version 0.7.0.","summary":"Endatix stores anonymous form submissions with file objects that can contain URLs, and later fetches those URLs from the server when a staff member downloads the files. An attacker can make the server send GET requests to internal services, cloud metadata endpoints, and loopback addresses, with the response only visible to staff in a ZIP file.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endatix","forms","package","self-hosted","ssrf"],"not_affected_if":["fixed-version","no-public-forms","recaptcha-enforced"],"how_to_check":"- Check the installed Endatix version and confirm whether it is below `0.7.0`\n- Look for forms with `IsPublic` and `IsEnabled` set that accept anonymous submissions\n- Review the server logs for outbound requests from the Endatix host to internal addresses after `POST /forms/{formId}/submissions/{submissionId}/files` calls","fix":"- Upgrade Endatix to `0.7.0` or later\n- Until upgraded, disable anonymous submissions on public forms or restrict egress from the Endatix server to internal address ranges and cloud metadata endpoints","status":"open","published_at":"2026-10-28T20:18:27+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:19+00:00","updated_at":"2026-10-28T20:36:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T20:36:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Endatix to `0.7.0` or later\n- Until upgraded, disable anonymous submissions on public forms or restrict egress from the Endatix server to internal address ranges and cloud metadata endpoints","reach":"internet","title":"Endatix: stored submission file URLs let staff trigger server-side requests","impact":"medium","summary":"Endatix stores anonymous form submissions with file objects that can contain URLs, and later fetches those URLs from the server when a staff member downloads the files. An attacker can make the server send GET requests to internal services, cloud metadata endpoints, and loopback addresses, with the response only visible to staff in a ZIP file.","category":"package","nicknames":[],"who_cares":["endatix","self-hosted","ssrf","forms"],"confidence":0.8,"needs_auth":"no","worst_case":"server makes internal requests; blind data exposure to staff viewer","analyst_note":"","how_to_check":"- Check the installed Endatix version and confirm whether it is below `0.7.0`\n- Look for forms with `IsPublic` and `IsEnabled` set that accept anonymous submissions\n- Review the server logs for outbound requests from the Endatix host to internal addresses after `POST /forms/{formId}/submissions/{submissionId}/files` calls","needs_analyst":false,"not_affected_if":["fixed-version","no-public-forms","reCAPTCHA-enforced"],"who_is_affected":"Self-hosted Endatix instances below 0.7.0 that have public forms accepting anonymous submissions with file fields. The exposure depends on the server's network position, since the requests originate from the server and can reach whatever it can reach internally. Instances on 0.7.0 or later, or with no public forms, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":3696,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61529':15A,18A '/files':150C '/forms':103C,146C '/submissions':105C,148C '0.7.0':99C,284C 'address':70B,172C,175C,198C 'anonym':28B,101C,215C 'api':96C 'assert':265C 'attack':54B,109C,239C,244C 'attacker-control':108C 'avail':262C 'base64':270C 'behavior':252C 'blind':246C 'call':161C 'check':113C 'cloud':65B,191C 'configur':222C 'contain':36B,131C 'content':128C,271C 'control':110C 'cve':13A,16A 'data':155C,266C 'decod':273C 'destin':166C 'direct':236C 'disclosur':241C 'download':50B 'endatix':1A,19B,26B,82C 'endpoint':67B,106C 'expos':255C 'fetch':40B,224C 'field':129C 'file':4A,32B,52B,81B,122C 'fix':281C 'form':20B,29B,88C,120C,206C 'formid':104C,147C 'get':60B,186C 'getfileshandl':151C 'headless':95C 'host':24B,87C,168C 'http':133C 'httpclient.getasync':162C 'https':135C 'impact':263C 'indirect':248C 'inform':254C 'integr':260C 'intern':63B,174C,189C 'invok':144C 'ip':171C 'isen':211C 'ispubl':209C 'issu':279C 'json':117C 'jsondata':111C 'later':39B 'let':6A 'link':196C 'link-loc':195C 'local':197C,274C 'loopback':69B,193C 'make':56B 'manag':91C 'member':49B,140C 'metadata':66B,192C 'must':207C,217C 'name':125C 'network':203C,276C 'object':33B,123C 'observ':250C 'order':182C 'packag':21B 'pass':152C,218C 'permiss':143C 'permit':178C 'place':227C 'platform':92C 'posit':204C 'post':102C,145C 'prior':97C 'rang':176C 'raw':269C 'raw-base64':268C 'recaptcha':219C 'request':12A,61B,187C,251C,277C 'resolv':170C 'respons':73B,225C 'return':235C 'second':181C 'second-ord':180C 'self':23B,86C 'self-host':22B,85C 'send':59B 'server':10A,45B,58B,184C,201C 'server-sid':9A,183C 'servic':64B,190C 'set':212C 'side':11A,185C 'src/endatix.infrastructure/features/submissions/submissionfileextractor.cs':159C 'ssrf':25B 'staff':7A,48B,77B,139C,230C 'store':2A,27B,107C,154C,179C 'submiss':3A,30B,216C 'submissionfileextractor':157C 'submissionid':149C 'submissions.view':142C 'survey':90C 'trigger':8A 'type':126C 'url':5A,37B,42B,136C,167C 'v3':220C 'valid':164C 'version':283C 'viewer':231C,258C 'visibl':75B 'well':119C 'without':163C,275C 'zip':80B,233C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Endatix instances below 0.7.0 that have public forms accepting anonymous submissions with file fields. The exposure depends on the server's network position, since the requests originate from the server and can reach whatever it can reach internally. Instances on 0.7.0 or later, or with no public forms, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61529","severity":null,"published_at":"2026-10-28T20:18:27+00:00","modified_at":"2026-10-28T20:18:27+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}