CVE-2026-112991 in Modules
Summary
by MITRE • 10/20/2026
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).
An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.
The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The html_to_markdown expansion module within the Malware Information Sharing Platform contains a critical server-side request forgery vulnerability rooted in an incomplete URL validation mechanism. This flaw resides specifically within the is_safe_url function, which relies on a static list of blocked IP address ranges to prevent requests from reaching internal or reserved network destinations. The security deficiency arises because this BLOCKED_RANGES configuration failed to account for several essential IPv4 and IPv6 address spaces that are commonly used in modern networking infrastructures. Specifically, the validation logic omitted 0.0.0.0/8, which on Linux systems routes to loopback addresses; 100.64.0.0/10, designated as carrier-grade NAT space per RFC 6598; ::/128 representing IPv6 unspecified address; fc00::/7 for IPv6 Unique Local Addresses; and fe80::/10 for IPv6 link-local addresses. The existing implementation only protected against traditional private ranges such as 127.0.0.0/8, RFC 1918 spaces, IPv4 link-local 169.254.0.0/16, and the specific IPv6 loopback address ::1/128, leaving significant gaps in network boundary enforcement that allow attackers to bypass standard internal IP filtering heuristics.
An authenticated user possessing permissions to create or modify MISP attributes can exploit this vulnerability by supplying URLs that resolve to these unblocked internal address ranges. When the html_to_markdown module processes such input, it initiates a server-side HTTP request from the context of the MISP application server rather than the client's browser. This architectural behavior transforms the vulnerable function into an SSRF proxy, enabling the attacker to probe and interact with services that are typically isolated behind firewalls or not exposed to external networks. The exploitation is further facilitated by the module’s handling of IPv4-mapped IPv6 address formats, such as [::ffff:0.0.0.0], which can bypass existing checks designed for standard dotted-decimal notation. Consequently, an attacker can leverage this mechanism to read responses from internal databases, administrative interfaces, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise remain inaccessible due to network segmentation policies.
The primary security impact of this vulnerability is a severe compromise of confidentiality within the organization's internal network topology. While the MISP instance itself remains uncompromised in terms of direct code execution or remote control, it is effectively abused as an unauthorized proxy to access restricted resources. This capability allows attackers to enumerate internal services, extract sensitive data from unprotected endpoints, and potentially map out the internal network structure for further exploitation attempts. The vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) due to its reliance on server-side request initiation based on user-supplied input without adequate validation of destination addresses. Furthermore, it maps to MITRE ATT&CK technique T1571 Non-Standard Port as attackers may target services running on non-standard ports that are not typically monitored by external security controls, and potentially T1046 Network Service Discovery if used for reconnaissance purposes within the internal network segment accessible from the MISP server.
Mitigation of this vulnerability requires an immediate update to the html_to_markdown expansion module's URL validation logic to include all relevant private, reserved, and link-local IP ranges in both IPv4 and IPv6 address families. Administrators should ensure that the BLOCKED_RANGES list explicitly includes 0.0.0.0/8, 100.64.0.0/10, fc00::/7, fe80::/10, and ::/128 alongside existing entries to prevent bypass via these address spaces. Additionally, the validation function must be enhanced to normalize and inspect IPv4-mapped IPv6 addresses before applying blocklist rules, ensuring that obfuscated representations of internal IPs are also rejected. In environments where immediate patching is not feasible, network-level controls such as egress filtering on the MISP server can serve as a compensating control by restricting outbound HTTP traffic to only explicitly trusted external domains and IP ranges, thereby preventing the server from reaching any internal or private address spaces regardless of application-layer validation failures.