Bug 2571855 (CVE-2026-65967) - CVE-2026-65967 github.com/getfider/fider: Fider: Server-Side Request Forgery via unvalidated webhook URLs
Summary: CVE-2026-65967 github.com/getfider/fider: Fider: Server-Side Request Forgery ...
Keywords:
Status: NEW
Alias: CVE-2026-65967
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-11 18:41 UTC by OSIDB Bzimport
Modified: 2026-11-11 20:49 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-11 18:41:40 UTC 
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.
Note You need to log in before you can comment on or make changes to this bug.