Dashboard / CVE-2026-59095

CVE-2026-59095

HIGH
MEDIUM Priority: 0.03 BB Relevance: 65/100
Published: 2026-07-02 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Changed
C: High
I: None
A: None

Description

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
lobehub lobehub 0 < 2.2.10

References & Advisories (3)

https://github.com/lobehub/lobehub/issues/16536
technical-description exploit issue-tracking

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.7 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS — Exploitation Probability

0.40%
Raw Score 0.004020
Percentile 34.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00402
2026-11-12
0.00402
2026-11-10
0.00402
2026-11-09
0.00402
2026-11-08
0.00402

Intelligence Sources

mitre ref →

External Links