CVE-2026-76795 in PullMD
Summary
by MITRE • 08/20/2026
A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in AeternaLabsHQ PullMD version 3.2.0 represents a critical security flaw within its REST API endpoint architecture, specifically affecting the handling of URL arguments passed to an unspecified function within the /api file path. This issue manifests as a Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to manipulate the server into making HTTP requests to arbitrary destinations under the control of the attacker. The root cause lies in insufficient validation or sanitization of user-supplied input before it is processed by the backend service, enabling malicious actors to redirect internal application logic toward external or internal network resources that should otherwise be inaccessible from the public internet.
From a technical perspective, SSRF vulnerabilities exploit the trust relationship between an application and its underlying infrastructure. In this case, because PullMD 3.2.0 fails to properly restrict the destinations of requests initiated via the REST API endpoint, an attacker can craft specific HTTP requests containing maliciously formatted URLs. These crafted payloads force the server to fetch resources from internal services, cloud metadata endpoints, or other sensitive backend systems. This capability is particularly dangerous as it bypasses traditional perimeter defenses such as firewalls that typically protect external-facing applications but may not inspect traffic originating internally from trusted application servers. The vulnerability can be initiated remotely without authentication in many configurations, significantly lowering the barrier to entry for exploitation and increasing the risk of widespread compromise.
The operational impact of this SSRF flaw is severe and multifaceted. Attackers can leverage this weakness to perform network reconnaissance by scanning internal ports or services that are not exposed publicly. Furthermore, they may access sensitive data stored in cloud provider metadata endpoints, such as AWS EC2 instance metadata service (IMDS), which often contains temporary security credentials, IAM roles, and other configuration details essential for system operation. In more advanced attack scenarios, the SSRF can be chained with other vulnerabilities to achieve remote code execution or full control over internal microservices. The fact that a public exploit has been disclosed means that automated scanning tools and malicious actors are actively targeting systems running this vulnerable version, leading to an elevated risk of immediate exploitation in unpatched environments.
This vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery as a flaw where the web server receives a URL from an end user and makes requests to that URL without proper validation. Additionally, it maps to MITRE ATT&CK technique T1571, specifically subtechnique T1571.001 for Non-Standard Port, although SSRF is often used broadly across various network layers to access internal resources. The lack of input sanitization on the url argument directly facilitates these unauthorized actions, undermining the confidentiality and integrity of the application's backend infrastructure.
To mitigate this risk, immediate action is required by upgrading AeternaLabsHQ PullMD from version 3.2.0 to version 3.3.0 or later. The patch identified by commit hash 96448894cc93ccecb0bdcbf263a9d25390a8455e addresses the underlying code defect that allows for unrestricted URL manipulation. Organizations should prioritize this upgrade in their maintenance windows to close the attack vector. In addition to upgrading, it is advisable to implement network-level controls such as web application firewalls (WAF) rules that detect and block SSRF patterns, restrict outbound traffic from application servers using strict egress filtering policies, and disable unnecessary HTTP methods on API endpoints. Regular security audits and penetration testing should also be conducted to ensure no similar input validation gaps exist in other parts of the REST API infrastructure.