CVE-2026-118586 in feedfinder2
Summary
by MITRE • 10/29/2026
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in dfm feedfinder2 versions up to 0.0.4 represents a critical security deficiency within the library's core functionality for locating RSS and Atom feeds from web pages. The specific flaw resides in the find_feeds function located in the feedfinder2.py module, where insufficient validation of user-supplied input allows an attacker to manipulate the target URL used during the discovery process. This lack of proper sanitization or restriction on allowed domains enables a Server-Side Request Forgery attack vector. In this context, the server acts as a proxy for the attacker's requests, leveraging its own network privileges and identity to interact with internal services that are typically not accessible from the external internet.
Server-side request forgery is particularly dangerous because it bypasses client-side security controls such as cross-origin resource sharing policies and firewalls that protect internal infrastructure. By exploiting this flaw, a remote attacker can force the vulnerable application to send crafted HTTP requests to arbitrary hosts on behalf of the server. This capability allows for reconnaissance activities against internal networks, exploitation of other vulnerabilities in backend services through SSRF-induced interactions, or even access to cloud metadata endpoints if the service is deployed within a cloud environment that exposes instance metadata via local addresses. The ability to perform remote exploitation means that no authentication or physical proximity to the target system is required, significantly lowering the barrier for attack execution and increasing the potential blast radius of the compromise.
From an industry standards perspective, this vulnerability aligns with CWE-918, which classifies Server-Side Request Forgery flaws where a web server retrieves a specified resource from a user-supplied URL without validating whether that request should be permitted to be sent. Additionally, in terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to T1571, specifically the Non-Standard Port or Internal Discovery techniques often associated with SSRF exploitation phases where attackers probe internal network segments for live hosts and services. The absence of a response from the project maintainers despite early notification highlights a gap in security maintenance practices that leaves users exposed until an official patch is released.
Mitigation strategies must focus on implementing strict input validation and output encoding at the application layer to prevent malicious URLs from being processed by the find_feeds function. Developers should enforce allow-listing of permitted domains or IP ranges for any outbound requests initiated by the library, ensuring that only expected external feed providers are accessed. Furthermore, deploying network-level controls such as egress filtering can provide a secondary defense in depth by blocking unauthorized outbound connections to internal subnets or cloud metadata endpoints. Until an official update is available, users should consider isolating instances of dfm feedfinder2 within restricted network segments and monitoring outgoing traffic for anomalies indicative of SSRF attempts.