CVE-2026-86119 in Webstudio
Summary
by MITRE • 09/05/2026
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
Webstudio versions through 0.296.0 are susceptible to an unauthenticated server-side request forgery vulnerability affecting critical proxy routes including /cgi/image, /cgi/video, and /cgi/asset. This security flaw arises specifically when the RESIZE_ORIGIN environment variable is not configured or remains unset within the application's deployment configuration. The core technical deficiency lies in how these endpoints handle URL inputs provided by clients without adequate validation or restriction mechanisms. When an attacker supplies arbitrary URLs to these proxy routes, the server processes the request and initiates outbound connections on behalf of the client. Because the RESIZE_ORIGIN variable is absent, the system fails to enforce a strict allowlist of permitted origins or domains for proxied requests. This lack of input validation allows malicious actors to direct the vulnerable application to fetch resources from arbitrary destinations rather than limiting access to intended internal or external assets.
The operational impact of this vulnerability is severe due to its unauthenticated nature, meaning no valid credentials are required to exploit it. Attackers can leverage this flaw to read cloud instance metadata services, which typically reside on non-routable IP addresses such as 169.254.169.254 in AWS or similar endpoints in other cloud providers like Azure and GCP. By forcing the server to request these internal metadata URLs, attackers can retrieve sensitive information including access keys, security tokens, and instance configuration details that facilitate further compromise of the underlying infrastructure. Furthermore, this vulnerability enables access to internal services running on localhost or within private network segments that are not exposed to the public internet but are accessible from the application server itself. This capability allows for unauthorized data exfiltration from databases, API endpoints, or administrative interfaces hosted internally.
Beyond immediate data theft, this flaw serves as a powerful tool for network reconnaissance and pivoting. Attackers can use the vulnerable proxy to scan internal networks, identify open ports, and map out the topology of the private infrastructure surrounding the Webstudio instance. This activity aligns with ATT&CK techniques related to Server Side Request Forgery (T1907) and potentially Internal Network Discovery if used in conjunction with other exploitation methods. The ability to interact with internal services can lead to broader system compromise, allowing attackers to escalate privileges or move laterally across the network environment. Since the vulnerability exists in common media and asset handling routes, it is likely exposed on publicly accessible interfaces, increasing the attack surface significantly for any deployment that does not explicitly configure the RESIZE_ORIGIN variable.
Mitigation strategies must focus on enforcing strict origin validation at the application level. Administrators should immediately set the RESIZE_ORIGIN environment variable to a whitelist of trusted domains or IP addresses from which proxy requests are permitted. This configuration ensures that the server only processes requests targeting allowed origins, thereby neutralizing the ability to reach internal metadata services and private network resources. Additionally, implementing input validation on all user-supplied URLs is essential to prevent arbitrary URL injection. Security teams should also consider deploying a Web Application Firewall configured with rules specifically designed to detect and block SSRF attempts involving cloud metadata IP ranges or localhost addresses. Regular security audits and penetration testing of proxy functionalities are recommended to ensure that similar configuration oversights do not persist in future deployments, maintaining the integrity and confidentiality of the underlying infrastructure.