CVE-2026-75332 in Zyplayer-Doc
Summary
by MITRE • 08/27/2026
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Zyplayer-Doc versions up to and including 1.0.0 represents a critical security flaw classified as Server-Side Request Forgery, specifically mapped under CWE-918 within the Common Weakness Enumeration framework. This type of vulnerability arises when an application retrieves a specified URL without validating whether that destination is trusted or safe, allowing an attacker to manipulate the input parameters sent to the server-side function WikiPageWebService.download(). By exploiting this lack of validation, malicious actors can force the vulnerable server to make HTTP requests to internal resources that are otherwise inaccessible from the external network. This effectively turns the application into a proxy for unauthorized access to backend systems, cloud metadata services, or local development servers running on the host machine.
From an operational perspective, the impact of this SSRF vulnerability is severe and multifaceted. An attacker can leverage the WikiPageWebService.download() endpoint to probe internal network topologies, identify active services, and potentially exfiltrate sensitive data stored in internal databases or configuration files that are not exposed publicly. Furthermore, if the application runs with elevated privileges or within a cloud environment, it may be possible to access instance metadata endpoints, such as those found on AWS EC2 instances at 169.254.169.254, which often contain temporary security credentials and other sensitive configuration details. This capability aligns with the ATT&CK technique T1071, Application Layer Protocol, where adversaries use legitimate application functions to facilitate lateral movement or data staging within a compromised network segment.
The technical root cause lies in the insufficient sanitization of user-supplied input passed to the download functionality. When a request is made to this endpoint, the server directly processes the provided URL parameter without implementing robust allow-lists for permitted domains or protocols. This oversight permits the use of internal IP addresses, localhost references, and potentially dangerous protocols like file:// or gopher:// depending on the underlying HTTP client library's configuration. The absence of strict validation allows attackers to bypass basic security controls that might otherwise restrict outbound connections to known external entities only.
Mitigation strategies must focus on implementing rigorous input validation and network-level restrictions at both the application and infrastructure layers. Developers should enforce a strict allow-list approach for any URLs processed by the download function, ensuring that only predefined, trusted domains are permitted. It is also critical to disable or restrict non-HTTP protocols if they are not strictly required for business logic. On the infrastructure side, network segmentation can help limit the blast radius of such an exploit by preventing the application server from communicating with sensitive internal services. Additionally, deploying a web application firewall that monitors outbound traffic patterns and blocks requests to private IP ranges can provide an additional layer of defense against SSRF attacks targeting internal resources.