CVE-2026-112299 in smr
Summary
by MITRE • 10/19/2026
A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability resides within the Album Website component of smrealms smr, specifically affecting versions up through commit f402e7f4e70b617b59d8c55dbe926b951ceb4a8. The core technical flaw is located in the isUrlReachable function within the src/pages/Account/AlbumEditProcessor.php file. This function is responsible for validating whether a provided URL points to an accessible resource, likely as part of a process that allows users to edit album details by specifying external image or media sources. However, the implementation fails to adequately restrict the protocols and destination hosts allowed during this validation check. By manipulating the Website argument passed to this function, an attacker can bypass intended security controls and force the server to initiate HTTP requests to arbitrary internal or external destinations. This specific failure mode is a classic example of Server-Side Request Forgery, commonly categorized under CWE-918 in the Common Weakness Enumeration framework. The vulnerability arises because the application trusts user-supplied input for URL construction without sufficient sanitization or allow-listing mechanisms, allowing an attacker to leverage the server's network privileges and identity.
The operational impact of this Server-Side Request Forgery (SSRF) vulnerability is significant due to its remote exploitability. Since the attack can be launched remotely over a network connection, it does not require prior authentication in many configurations, although some SSRF vectors may require low-privilege access depending on where the vulnerable function is exposed within the application logic. An attacker who successfully exploits this flaw can use the server as a proxy to scan internal networks that are otherwise inaccessible from the public internet. This capability enables reconnaissance of backend services such as database servers, administrative interfaces, or cloud metadata endpoints which often contain sensitive credentials and configuration data. Furthermore, depending on the specific network architecture, an SSRF attack could potentially lead to unauthorized access to private APIs, modification of internal systems, or even remote code execution if combined with other vulnerabilities in target services that process unexpected input types. The fact that this exploit has been publicly disclosed increases the risk landscape considerably, as automated scanning tools and malicious actors can readily utilize known proof-of-concept techniques to identify and compromise vulnerable instances without needing to develop custom exploitation logic from scratch.
The product smrealms smr operates on a rolling release basis, which means there are no discrete version numbers for affected or patched releases in the traditional sense. Instead, security updates are delivered continuously as part of the ongoing development cycle. The specific patch addressing this vulnerability is identified by commit hash cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Because of the rolling release model, administrators must ensure their systems are updated to include commits newer than or equal to this specific patch identifier to mitigate the risk. The vendor demonstrated a responsive and professional approach by quickly releasing a fixed version after being contacted early in the discovery process. This rapid response time is critical for minimizing the window of exposure during which attackers could exploit the publicly disclosed vulnerability. To align with industry best practices, organizations should also consider implementing network-level mitigations such as egress filtering to restrict outbound connections from application servers to only known and necessary destinations. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking anomalous HTTP requests that exhibit characteristics typical of SSRF attacks, thereby reducing the attack surface even before patches are fully deployed across all environments.