CVE-2026-107273 in Gophish
Summary
by MITRE • 10/07/2026
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
Gophish versions 0.11.0 through 0.12.1 are susceptible to a server-side request forgery vulnerability within the POST /api/import/site endpoint. This flaw permits authenticated low-privileged users, who typically have limited access rights such as creating campaigns or viewing reports, to initiate HTTP requests from the Gophish server itself rather than directly from their own client machines. The core technical deficiency lies in the implementation of the URL import functionality, which allows an attacker to specify arbitrary target URLs for phishing page templates. When a user submits a URL containing internal network addresses, such as loopback interfaces or private IP ranges, the application attempts to fetch and parse that content server-side to generate the campaign template.
The vulnerability is exacerbated by the configuration of the default dialer deny list used during these outbound requests. While Gophish includes security measures intended to prevent SSRF attacks by blocking access to reserved address spaces like 127.0.0.0/8 and private RFC 1918 ranges, this specific implementation fails to adequately restrict all internal endpoints or relies on a deny list that can be bypassed through various techniques such as DNS rebinding or alternative IP representations. Consequently, an attacker with valid credentials but low privilege levels can craft requests targeting services running on the local host or other machines within the same private network segment. This capability effectively turns the Gophish server into a proxy for internal reconnaissance and data exfiltration from resources that are not exposed to the public internet.
The operational impact of this vulnerability is significant, particularly in environments where Gophish is deployed alongside sensitive internal services such as administrative dashboards, database management interfaces, or configuration panels. By submitting carefully crafted URLs pointing to these internal services, an attacker can read HTTP responses returned by those services. Even if the target service does not return full page content due to authentication requirements, error messages often reveal valuable information about the technology stack, version numbers, and available endpoints. This process facilitates detailed enumeration of internal hosts and open ports, allowing the attacker to map out the network topology and identify additional vectors for further exploitation. The ability to interact with loopback services also poses a risk if any local applications are configured without proper authentication or bind exclusively to localhost under the assumption that they are protected from external access.
This vulnerability aligns with CWE-918, which defines Server-Side Request Forgery (SSRF), specifically involving the lack of validation for user-supplied URLs before server-side processing. From a tactical perspective, this behavior corresponds to ATT&CK technique T1572, Protocol Tunneling, as well as aspects of reconnaissance and discovery phases where an attacker leverages compromised systems to probe internal networks. The exploitation does not require privilege escalation beyond the initial low-privileged account, making it accessible to threat actors who have already gained a foothold in the application through credential theft or phishing success against lower-level staff.
Mitigation strategies should prioritize immediate patching of Gophish to version 0.12.2 or later, where this specific SSRF flaw has been addressed with more robust input validation and stricter enforcement of allow-lists for outbound connections rather than relying solely on deny lists which are prone to bypasses. In the interim, organizations running vulnerable versions should restrict network access to Gophish servers using firewall rules that prevent them from initiating connections to internal IP ranges unless absolutely necessary for legitimate business functions. Additionally, implementing strict output encoding and sanitization of any data returned from imported sites can help mitigate information leakage through error messages. Security teams should also audit existing campaigns and templates to ensure no malicious URLs were injected during the window of vulnerability, and enforce multi-factor authentication on all Gophish accounts to reduce the risk of unauthorized access by low-privileged users.