{"id":"CVE-2026-82044","published":"2026-10-02T21:16:56.933","lastModified":"2026-10-06T15:25:00.650","description":"UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16","tags":[]},{"url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","tags":[]},{"url":"https://www.vulncheck.com/advisories/utmstack-server-side-request-forgery-via-downloadpdf","tags":[]}],"exploitRefs":[{"url":"https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16","tags":[]},{"url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","tags":[]}],"hasPoc":true,"ai":{"summary":"UTMStack contains a server-side request forgery vulnerability in its PDF generation service that allows authenticated attackers to access internal resources by crafting malicious URLs, potentially exposing sensitive backend data in generated PDF reports.","exploitability":"The exploit requires authentication and involves sending a crafted URL parameter to the /api/generate-pdf-report endpoint, making it moderately difficult to exploit without prior access to valid credentials.","blast_radius":"If exploited, this vulnerability could expose internal backend services, OpenSearch clusters, or cloud metadata, potentially leading to data leakage from sensitive internal systems.","remediation":"Upgrade to UTMStack 11.2.16 or later to address this server-side request forgery vulnerability.","detection":"Monitor for requests to /api/generate-pdf-report with suspicious URL parameters in web server logs, particularly those containing internal IP addresses or service endpoints that should not be publicly accessible.","tags":["ssrf","pdf","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:52:23.889Z"}}